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Foreword 



rd , 



This Technical Specification (TS) has been produced by the 3 Generation Partnership Project (3GPP). 

The contents of the present document are subject to continuing work within the TSG and may change following formal 
TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an 
identifying change of release date and an increase in version number as follows: 

Version x.y.z 

where: 

X the first digit: 

1 presented to TSG for information; 

2 presented to TSG for approval; 

3 or greater indicates TSG approved document under change control. 

Y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, 
updates, etc. 

Z the third digit is incremented when editorial only changes have been incorporated in the document. 
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Scope 



The present document defines the interface between the UICC and the Mobile Equipment (ME), and mandatory ME 
procedures, specifically for "USIM Application Toolkit". 

The present document refers in its majority to the ETSI TS 102 223 [32], which describes the generic aspects of 
application toolkits within the UICC. 

USAT is a set of commands and procedures for use during the network operation phase of 3G/LTE, in addition to those 
defined in TS 31.101 [13]. 

Specifying the interface is to ensure interoperability between a UICC and an ME independently of the respective 
manufacturers and operators. 

The present document defines for 3G/LTE technology: 

the commands; 

the application protocol; 

the mandatory requirements on the UICC and ME for each procedure. 

The present document does not specify any aspects related to the administrative management phase. Any internal 
technical realization of either the UICC or the ME are only specified where these reflect over the interface. The present 
document does not specify any of the security algorithms which may be used. 

For the avoidance of doubt, references to clauses of ETSI TS 102 223 [32] include all the subclauses of that clause, 
unless specifically mentioned. 

The target specification ETSI TS 102 223 [32] contains material that is outside of the scope of 3GPP requirements and 
the present document indicates which parts are in the scope and which are not. 

A 3GPP ME may support functionality that is not required by 3GPP, but the requirements to do so are outside of the 
scope of 3GPP. 
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[32] ETSI TS 102 223 VI 1.0.0: "Smart Cards; Card AppHcation Toolkit". 

[33] 3GPP TR 21.905: "Vocabulary for 3GPP specifications". 

[34] 3GPP TS 22.101: "Service aspects; Service principles". 

[35] 3GPP TS 25.401: "UTRAN overall description". 

[36] 3GPP TS 25.413: "UTRAN lu interface RANAP signalling". 

[37] 3GPP TS 24.090: "Unstructured Supplementary Service Data (USSD) - Stage 3". 

[38] 3GPP TS 25.331: "Radio Resource Control (RRC) Protocol Specification". 

[39] 3GPP TS 25.133: "Requirements for support of radio resource management". 
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[40] Void. 

[41] 3GPP TS 31.1 15: "Secured packet structure for the (U)SIM Toolkit applications". 

[42] 3GPP TS 24.234: "3GPP System to WLAN Interworking; UE to Network protocols; Stage 3". 

[43] ETSI TS 101 220: "Smart Cards; ETSI numbering system for telecommunication application 

providers ". 

[44] 3GPP TS 23.032: "Universal Geographical Area Description (GAD)". 

[45] lEC 61 162-1: "Maritime navigation and radio communication equipment and systems - Digital 

interfaces". 

[46] 3GPP TS 24.301 : "Non-Access-Stratum (NAS) protocol for Evolved Packet Systems (EPS): Stage 

3". 

[47] 3GPP TS 23.203: "PoHcy and charging control architecture". 

[48] 3GPP TS 36.401 : "Evolved Universal Terrestrial Radio Access Network (E-UTRAN); 

Architecture description". 

[49] 3GPP TS 36.33 1 : "Evolved Universal TeiTestrial Radio Access (E-UTRA); Radio Resource 

Control (RRC); Protocol specification". 

[50] 3GPP TS 36.133: " Evolved Universal Terrestrial Radio Access (E-UTRA); Requirements for 

support of radio resource management" . 

[51] 3GPP TS 31.1 16: "Remote APDU Structure for (U)SIM Toolkit appHcations". 

[52] 3GPP TS 24.229 "IP multimedia call control protocol based on SIP and SDP; stage 3" 

[53] IETF RFC 3261: "SIP: Session Initiation Protocol". 

[54] IETF RFC 3629 (2003): "UTF-8, a transformation format of ISO 10646". 

[55] IETF RFC 3680 (2004): "A Session Initiation Protocol (SIP) Event Package for Registrations". 

[56] 3GPP TS 3 1 . 104: "Characteristics of the Hosting Party Subscription Identity Module (HPSIM) 

application" 

[57] 3GPP TS 32.582: "Telecommunications management; Home Node B (HNB) Operations, 

Administration, Maintenance and Provisioning (OAM&P); Information model for Type 1 interface 
HNB to HNB Management System (HMS)". 

[58] 3GPP TS 32.592: "Telecommunications management; Home Node B (HeNB) Operations, 

Administration, Maintenance and Provisioning (OAM&P); Information model for Type 1 interface 
HeNB to HeNB Management System (HeMS)". 



3 Definitions, abbreviations and symbols 

3.1 Definitions 

For the purposes of the present document, the terms and definitions given in ETSI TS 102 223 [32] clause 3.1 and 
TR 21.905 [33] apply. 

Within the context of the present document, the term "terminal" used in ETSI TS 102 223 [32] refers to the Mobile 
Equipment (ME). 

Within the context of the present document, the term "NAA" used in ETSI TS 102 223 [32] refers to the USIM. 
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Within the context of the present document, the term "CAT" used in ETSI TS 102 223 [32] refers to the USAT. 



3.2 



Abbreviations 



For the purpose of the present document, the abbreviations given in ETSI TS 102 223 [32] and TR 21.905 [33] and the 
following apply: 

ADN Abbreviated Dialling Number 

CB Cell Broadcast 

CBMID Cell Broadcast Message Identifier 

CSG Closed Subscriber Group 

EGPRS EDGE General Packet Radio Service 

EPS Evolved Packet System 

E-UTRAN Evolved Universal Terrestrial Radio Access Network 

FDN Fixed Dialling Number 

GGSN Gateway GPRS Support Node 

GPRS General Packet Radio Service 

GSM Global System for Mobile communications 

H(e)NB Home Node B or Home evolved Node B 

HPSIM Hosting Party Subscription Identity Module 

HSDPA High Speed Downlink Packet Access 

lARI IMS Application Reference Identifier 

IMPU IMS Public User Identity 

MM Multimedia Message 

MMS Multimedia Messaging Service 

MMI Man Machine Interface 

NA No Audio-alerting capability 

ND No Display capability 

NK No Keypad capability 

NL No support of multiple Languages 

NS No Speech-call capability 

PDN Packet Data Network 

PDP Packet Data Protocol, e.g., Ip or X25 or PPP 

RFU Reserved for Future Use 

SS Supplementary Service 

SSC Supplementary Service Control string 

USAT USIM AppHcation Toolkit 

USIM Universal Subscriber Identity Module 

USSD Unstructured Supplementary Service Data 

WSID WLAN Specific Identifier 



3.3 Symbols 



For the purposes of the present document, the following symbols apply: 
'0' to '9' and 'A' to 'F' The sixteen hexadecimal digits. 



Overview of USAT 



The USAT provides mechanisms which allow applications, existing in the UICC, to interact and operate with any ME 
which supports the specific mechanism(s) required by the application. 

The following mechanisms have been defined. These mechanisms are dependent upon the commands and protocols 
relevant to USAT in TS 31.101 [13]. 



4.1 



Profile Download 



Profile downloading provides a mechanism for the ME to tell the UICC what it is capable of. 
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4.2 Proactive UICC 

Proactive UICC gives a mechanism whereby the UICC can initiate actions to be taken by the ME. The supported 
functions are specified in clause 6.4. 

For each command involved in the dialog with the user, a help information may be available, either for each item of a 
list of items proposed to the user, or with each command requesting a response from the user. If a proactive command 
involved in the dialog with the user indicates the availability of the help feature, the support of this feature is optional 
for the terminal. 

4.3 Data download to UICC 

Data downloading to the UICC uses either dedicated commands (the transport mechanisms of SMS point-to-point and 
Cell Broadcast) or the Bearer independent protocol. Transferral of information over the UICC-ME interface uses the 
ENVELOPE command. 

4.4 Menu selection 

See ETSI TS 102 223 [32] clause 4.4. 



4.5 Call control by USIM 



When this service is activated by the USIM, all dialled digit strings, supplementary service control strings and USSD 
strings, PDP context parameters or IMS communications parameters are first passed to a USIM application before the 
ME sets up the call, the supplementary service operation or the USSD operation, establishes the PDP context or initiate 
IMS communications. The ME shall also pass to the USIM application at the same time its current serving cell. The 
USIM application has the ability to allow, bar or modify the call, the supplementary service operation or, the USSD 
operation, PDP context activation or IMS communication set up by another context activation. The USIM application 
also has the ability to replace a call request, a supplementary service operation or a USSD operation by another call 
request or supplementary service operation or USSD operation. 

EXAMPLE: A call request can be replaced by a supplementary service operation or a USSD operation, and 

vice-versa. 

4.6 MO Short Message control by USIM 

When this service is activated by the USIM, all MO short messages are first passed to the USIM application before the 
ME sends the short message. The ME shall also pass to the USIM application at the same time its current serving cell. 
The USIM application shall have the ability to allow the sending, bar the sending or modify the destination address of 
the short message before sending it. 

4.7 Event download 

In addition to the set of events defined in ETSI TS 102 223 [32] clause 4.7, the following event may also be reported to 
the UICC: 

Network Rejection 

CSG cell selection (if class "q" is supported) 

Incoming IMS Data (if classes "e" and "t" are supported) 

IMS Registration (if classes "e" and "t" are supported) 

4.8 Security 

See ETSI TS 102 223 [32] clause 4.8. 
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4.9 Multiple card 

See ETSI TS 102 223 [32] clause 4.9. 

4.10 Timer Expiration 

See ETSI TS 102 223 [32] clause 4.10. 

4.1 1 Bearer Independent Protocol 

See ETSI TS 102 223 [32] clause 4.11. 

4.12 Description of the access technology indicator mechanism 

See ETSI TS 102 223 [32] clause 4.12. 

4.13 Description of the network search mode mechanism 

See ETSI TS 102 223 [32] clause 4.14. 

4.14 Geographical location discovery 

The proactive command Geographical Location Request and the envelope command Geographical Location Reporting 
allows the UICC to request and receive the current geographical location information from the ME when the ME is 
equipped with a positioning feature and it is enabled (e.g. autonomous GPS, Assisted GPS or Assisted GNSS). 

4.15 Operation in reduced USAT capable terminals 

This specification takes into account terminal types corresponding to the following capabilities: 

- no display capability 

- no keypad available 

- no audio alerting capability 
no speech call capability 

no support of multiple languages. 
These terminal types are used to identify which USAT features are not available for each type of reduced functionality. 
Note: Terminal types details are in Annex P. 

4.16 Tag allocation guidelines 

See ETSI TS 102 223 [32] clause 4.13. 

4.17 USAT over the AT interface 

See ETSI TS 102 223 [32] clause 4.16. 
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4. 1 8 USAT facilities provided by eCAT clients 

Not required by 3GPP. 

5 Profile download 

5.1 Procedure 

The profile download instruction is sent by the ME to the UICC as part of the UICC initialization procedure. The UICC 
initialization procedure is specified in TS 31.101 [13]. If class "s" is supported, the profile download instruction is sent 
also every time the TE accessing USAT functionalities over the AT interface is connected or disconnected or changes 
its profile. If the terminal supports class "s" the profile download instruction shall combine capabilities supported by the 
MT and the TE according to Annex Q. 

If the UICC indicates the support of "Additional TERMINAL PROFILE after UICC activation" in its USIM Service 
Table, the ME shall handle the profile download procedure as specified in ETSI TS 102 223 [32] clause 5.1. 

If the UICC does not indicate the support of "Additional TERMINAL PROFILE after UICC activation" in its USIM 
Service Table, the profile download instruction shall only be sent by the ME to the UICC as part of the UICC 
initialization procedure. However, if a USIM initialisation procedure is performed due to a refresh proactive command, 
the USIM initialisation procedure may also include a profile download. 

The profile(s) sent by the ME shall state the facilities relevant to USAT that are supported by the ME. 

5.2 Structure and coding of TERMINAL PROFILE 

Direction: ME to UICC. 

The command header is specified in TS 31.101 [13]. 

Command parameters/data: 



Description 


Clause 


M/O/C 


Length 


Profile 


- 


M 


igth 



- Profile: 
Contents: 

The list of USAT facilities that are supported by the ME. 
Coding: 

1 bit is used to code each facility: 

- bit = 1 : facility supported by ME. 

- bit = 0: facility not supported by ME. 

NOTE: several bits may need to be set to 1 for the support of the same facility. This is because of backward 

compatibility with SAT: several options existed in SAT for a given facility, and they are mandatory in 
USAT when this facility is supported. 

First byte (Download): 
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b8 b7 b6 b5 b4 b3 b2 bl 



See TS 102 223 [32] clause 5.2 

SMS-PP data download 

Cell Broadcast data download 

See TS 102 223 [32] clause 5.2 

Bit = 1 if SMS-PP data download is supported 

See TS 102 223 [32] clause 5.2 

Bit = 1 if Call Control by USIM is supported 

Bit = 1 if Call Control by USIM is supported 



Second byte (Other): 



b8 b7 b6 b5 b4 b3 b2 bl 



See TS 102 223 [32] clause 5.2 
Call Control by USIM 

Bit = 1 if Call Control by USIM is supported 
MO s]iort message control by USIM 
Bit = 1 if Call Control by USIM is supported 
See TS 102 223 [32] clause 5.2 
See TS 102 223 [32] clause 5.2 
"see TS 102 223 [32] clause 5.2 



Third byte (Proactive UICC): 

- See ETSI TS 102 223 [32] clause 5.2. 
Fourth byte (Proactive UICC): 



b8 b7 b6 b5 b4 b3 b2 bl 



[32] clause 5.2 

SEND SHORT MESSAGE 

SEND SS 

SEND USSD 
[32] clause 5.2 
[32] clause 5.2 
[32] clause 5.2 

PROVIDE LOCAL INFORMATION (NMR) 



See TS 102 223 

Proactive UICC 

Proactive UICC 

Proactive UICC 
"see TS 102 223 
"see TS 102 223 
"see TS 102 223 

Proactive UICC 

3GPP terms, tliis indicates support for GERAN 



Fifth byte (Event driven information): 

- See ETSI TS 102 223 [32] clause 5.2. 
Sixth byte (Event driven information extensions): 

- See ETSI TS 102 223 [32] clause 5.2. 

Seventh byte (Multiple card proactive commands) for class "a": 

- See ETSI TS 102 223 [32] clause 5.2. 
Eighth byte (Proactive UICC): 



b8 b7 b6 b5 b4 b3 b2 bl 



See 


TS 


102 


223 


[32] 


clause 


5 


2 


See 


TS 


102 


223 


[32] 


clause 


5 


2 


See 


TS 


102 


223 


[32] 


clause 


5 


2 


See 


TS 


102 


223 


[32] 


clause 


5 


2 


See 


TS 


102 


223 


[32] 


clause 


5 


2 


See 


TS 


102 


223 


[32] 


clause 


5 


2 


See 


TS 


102 


223 


[32] 


clause 


5 


2 



Bit = 1 if Call Control by USIM is supported 
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Ninth byte: 



b8 b7 b6 b5 b4 b3 b2 bl 



See TS 102 223 [32] clause 5.2 

See TS 102 223 [32] clause 5.2 

See TS 102 223 [32] clause 5.2 

See TS 102 223 [32] clause 5.2 

Proactive UICC: PROVIDE LOCAL INFORMATION {Timing 

Advance) 

See TS 102 223 [32] clause 5.2 

See TS 102 223 [32] clause 5.2 

See TS 102 223 [32] clause 5.2 



Tenth byte (Soft keys support) for class "d": 

- See ETSI TS 102 223 [32] clause 5.2. 
Eleventh byte: (Soft keys information): 

- See ETSI TS 102 223 [32] clause 5.2. 

Twelfth byte (Bearer Independent protocol proactive commands) for class "e": 

- See ETSI TS 102 223 [32] clause 5.2. 

Thirteenth byte (Bearer Independent protocol supported bearers) for class "e": 

- See ETSI TS 102 223 [32] clause 5.2. 
Fourteenth byte: (Screen height): 

- See ETSI TS 102 223 [32] clause 5.2. 
Fifteenth byte: (Screen width): 

- See ETSI TS 102 223 [32] clause 5.2. 
Sixteenth byte: (Screen effects): 

- See ETSI TS 102 223 [32] clause 5.2. 

Seventeenth byte (Bearer independent protocol supported transport interface/bearers) for class "e": 



b8 bV b6 b5 b4 b3 b2 bl 



See TS 102 223 [32] clause 5.2 

E-UTRAN 

HSDPA 



Eighteenth byte: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



See TS 102 223 [32] clause 5.2 

CALL CONTROL on GPRS 

See TS 102 223 [32] clause 5.2 



Nineteenth byte: (reserved for TIA/EIA-136 facilities): 

- See ETSI TS 102 223 [32] clause 5.2. 
Twentieth byte: (reserved for TIA/EI A/IS -820 facilities): 

- See ETSI TS 102 223 [32] clause 5.2. 

Twenty-first byte (Extended Launch Browser Capability) for class "c": 
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- See ETSI TS 102 223 [32] clause 5.2. 
Twenty second byte: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



Support of UTRAN PS with extended parameters 

See TS 102 223 [32] clause 5.2 

Toolkit-initiated GBA 

See TS 102 223 [32] clause 5.2 

See TS 102 223 [32] clause 5.2 

See TS 102 223 [32] clause 5.2 



Twenty third byte: 



b8 b7 b6 b5 b4 bS b2 bl 



See TS 102 223 [32] clause 5.2 

Geographical Location Reporting (if class "n" is 
supported) 

See TS 102 223 [32] clause 5.2 
Proactive UICC: PROVIDE LOCAL INFORMATION 
(NMR(UTRAN/E-UTRAN) ) 

USSD Data download and application mode (if class 
"p" is supported) 



Twenty fourth byte for class "i": 

- See ETSI TS 102 223 [32] clause 5.2. 
Twenty-fifth byte (Event driven information extensions): 

I b8 I bV I b6 I b5 I b4 I b3 I b2 I bl I 



See TS 102 223 [32] clause 5.2 

Event: I-WLAN Access status (if class "e" is 

supported) 

Event: Network Rejection for GERAN/UTRAN 

Reserved by ETSI SCP: HCI connectivity event (i.e. 

class "m" is supported) 

Event: Network Rejection for E-UTRAN 

See TS 102 223 [32] clause 5.2 



Twenty-sixth byte (Event driven information extensions): 



b8 bV b6 b5 b4 b3 b2 bl 



Event : CSG Cell Selection (if class "q" is 

supported) 

Reserved by ETSI SCP: Contactless state request (if 

class "r" is supported 

See TS 102 223 [32] clause 5.2 



Twenty-seventh byte (Event driven information extensions): 

- See ETSI TS 102 223 [32] clause 5.2. 
Twenty-eighth byte (Text attributes): 

- See ETSI TS 102 223 [32] clause 5.2. 
Twenty-ninth byte (Text attributes): 

- See ETSI TS 102 223 [32] clause 5.2. 
Thirtieth byte: 
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b8 b7 b6 b5 b4 b3 b2 bl 



I-WLAN bearer support {if class "e" is supported) 

Proactive UICC: PROVIDE LOCAL INFORMATION {WSID of 

the current I-WLAN connection) 

TERMINAL APPLICATIONS {i.e. class "k" is supported) 

"Steering of Roaming" REFRESH support 

Reserved by ETSI SCP: Proactive UICC command 

ACTIVATE {i.e class "1" is supported) 

Proactive UICC: Geographical Location Request {if 

class "n" is supported) 

See TS 102 223 [32] clause 5.2 

"Steering of Roaming for I-WLAN" REFRESH support 



Thirty-first byte: 



b8 b7 b6 b5 b4 b3 b2 bl 



See TS 102 223 [32] clause 5.2 

Support of CSG cell discovery {if class "q" is 

supported) 

See TS 102 223 [32] clause 5.2 

Communication Control for IMS 

See TS 102 223 [32] clause 5.2 

Support for Incoming IMS Data event {if classes "e 

and "t" are supported) 

Support for IMS Registration event {if classes "e" 

and "t" are supported) 

Reserved by ETSI SCP: Proactive UICC: Profile 

Container, Envelope Container, COMMAND CONTAINER 

and ENCAPSULATED SESSION CONTROL {if class "u" is 

supported) 



Thirty-second byte: 



b8 b7 b6 b5 b4 b3 b2 bl 



IMS support {if class "e" and "t" are supported) 
Support of PROVIDE LOCATION INFORMATION, H{e)NB IP 
address {if class "v" is supported) 
support of PROVIDE LOCATION INFORMATION, H{e)NB 
surrounding macrocells {if class "w" is supported) 



See 


TS 


102 


223 


[32] 


clause 


5 


2 


See 


TS 


102 


223 


[32] 


clause 


5 


2 


See 


TS 


102 


223 


[32] 


clause 


5 


2 


See 


TS 


102 


223 


[32] 


clause 


5 


2 


See 


TS 


102 


223 


[32] 


clause 


5 


2 



Subsequent bytes: 

- See ETSI TS 102 223 [32] clause 5.2. 
Response parameters/data: 
None. 



5.3 Definition of display parameters in Profile download 



See ETSI TS 102 223 [32] clause 5.3. 
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6 Proactive UICC 

6.1 Introduction 

TS 31.101 [13] defines the communication protocols between the ME and the UICC, and defines a mechanism to 
transport "proactive" commands using these protocols. Details about how this mechanism is used for USAT are defined 
in TS 102 223 [32] clause 6.1. The supported proactive commands are specified in clause 6.4. of the present document. 

If the UICC issues an instruction to the ME to initiate a Mobile Originated transaction (e.g. SEND SMS, SEND SS, 
SEND USSD or SEND DTMF), then unless expHcitly stated elsewhere in the present document or in TS 31.101 [13], 
the content supplied by the UICC for onward transmission by the ME shall not be altered by the ME. 

6.2 Identification of ME support 

See ETSl TS 102 223 [32] clause 6.2. 

6.3 General procedure 

See ETSl TS 102 223 [32] clause 6.3. 

6.4 Proactive UICC commands and procedures 

6.4.1 DISPLAY TEXT 

See ETSl TS 102 223 [32] clause 6.4.1. 

6.4.2 GET INKEY 

See ETSl TS 102 223 [32] clause 6.4.2. 

6.4.3 GET INPUT 

See ETSl TS 102 223 [32] clause 6.4.3. 

6.4.4 MORE TIME 

See ETSl TS 102 223 [32] clause 6.4.4. 

6.4.5 PLAY TONE 

See ETSl TS 102 223 [32] clause 6.4.5. 

NOTE: Some supervisory tones are optional for mobile equipment (see TS 22.001 [22]). 

6.4.6 POLL INTERVAL 

See ETSl TS 102 223 [32] clause 6.4.6. 

6.4.7 REFRESH 

See ETSl TS 102 223 [32] clause 6.4.7 except for "3G Session Reset" and "Steering of Roaming" which are defined as 
follows. 
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3G Session Reset. This mode causes the ME to reset the 3G session, in accordance with the 3G session reset procedure 
defined in TS 31.102 [14]. Subsequently, the ME performs the "USIM InitiaHzation and File Change Notification" 
procedure and the MM Restart procedure as defined in TS 23.122 [7]. 

Steering of Roaming. This mode triggers a steering of roaming procedure as defined in TS 23.122 [7] or a steering of 
roaming for I-WLAN procedure as defined in TS 24.234 [42]. 

6.4.7.1 EFiMsi changing procedure 

When an EFimsi is changed via Data Download or a USAT application and a REFRESH command is issued by the 
UICC the following rules apply to the UlCC and ME: 

- USIM Initialization. This command shall not be used if an EFimsi is changed, as the behaviour of the UE is 
unpredictable; 

File Change Notification. This command shall not be used if an EFimsi is changed, as the behaviour of the UE is 
unpredictable; 

USIM Initialization and File Change Notification. This command shall not be used if an EFimsi is changed, as the 
behaviour of the UE is unpredictable; 

USIM Initialization and Full File Change Notification. This command shall not be used if an EFimsi is changed, 
as the behaviour of the UE is unpredictable; 

UICC Reset. Normal UICC Reset procedure is carried out; 

USIM Application Reset. Normal USIM Application Reset procedure is carried out; 

3G Session Reset. Normal 3G Session Reset procedure is carried out. 

If an EFimsi is to be updated, neither EFimsi , EFpsloci , EFepsloci nor EFloci shall be updated in the UICC before the 
3G session termination procedure has been completed by the ME. 

6.4.7.2 Generic Bootstrapping Procedure Request 

If Toolkit-initiated GBA is supported by the ME, as indicated in the TERMINAL PROFILE, then the following appUes: 

When the UICC issues a REFRESH command implying a File Change Notification on EFgbabp under ADF USIM 
(GBA Bootstrapping parameters) the ME shall perform a GBA bootstrapping procedure (as defined in TS 31.102 [14]). 

This procedure applies to REFRESH command only in the following modes: USIM File Change Notification; USIM 
Initialization and File Change Notification; and 3G Session Reset. 

6.4.7.3 EFuicciARi changing procedure 

When an EFuicciari is changed in either the USIM or the ISIM via Data Download or a USAT application and a 
REFRESH command is issued by the UICC the following rule applies to the ME: 

The ME shall read the updated list of lARIs associated with active applications installed on the UICC and follow the 
procedures defined in TS 24.229 [52]. 

6.4.7.4 Steering of roaming and steering of roaming for I-WLAN procedure 

The steering of roaming procedures defined in TS 23.122 [7] and in TS 24.234 [42] might take a long time. In order to 
avoid blocking the Toolkit interface, the ME shall send the TERMINAL RESPONSE (Command performed 
successfully) immediately after starting the steering of roaming procedure, without waiting for its completion. The ME 
shall send TERMINAL RESPONSE (ME unable to process command or other appropriate code) in case it fails to start 
the steering of roaming procedure. 

6.4.8 SET UP MENU 

See ETSI TS 102 223 [32] clause 6.4.8. 
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6.4.9 SELECT ITEM 

See ETSI TS 102 223 [32] clause 6.4.9. 

6.4.10 SEND SHORT MESSAGE 

This command requests the ME to send a short message. 

Two types are defined in ETSI TS 102 223 [32] clause 6.4.10 and apply as follows within the context of the present 
document: 

a short message to be sent to the network in an SMS-SUBMIT message, or an SMS -COMMAND message, 
where the user data can be passed transparently; 

a short message to be sent to the network in an SMS-SUBMIT message where the text needs to be packed by the 
ME. 

Where the text has been packed, the text string provided by the UICC shall not be longer than 160 characters. It shall 
use the SMS default 7-bit coded alphabet, packed into 8-bit octets, in accordance with TS 23.038 [4]. The data coding 
indication contained in the Data Coding Scheme byte shall be "default alphabet". The text length (which is part of the 
SMS TPDU) given by the UICC shall state the number of 7-bit characters in the text string. The command details shall 
indicate "packing not required". 

8-bit data Short Messages may be sent by the UICC. The command shall indicate packing not required. The data coding 
indication contained in the Data Coding Scheme byte shall be "8 bit". The string shall not be longer than 140 bytes, and 
the length (in SMS TPDU) shall state the number of bytes in the string. 

If UCS2 is supported by the ME, 16-bit data Short Messages may be sent by the UICC. The text string provided by the 
UICC shall not be longer than 70 characters. It shall use the 16-bit UCS2 alphabet format, in accordance with 
TS 23.038 [4]. The text length (which is part of the SMS TPDU) given by the UICC shall state the number of 16-bit 
characters in the text string. The command details shall indicate "packing not required". 

SMS commands may be sent by the UICC. These shall count as packed text message. The SMS TPDU from the UICC 
shall indicate SMS-COMMAND. The command details shall indicate "packing not required". 

Where packing by the ME is required, the text string provided by the UICC shall not be longer than 160 characters. It 
shall use the SMS default 7-bit coded alphabet as defined in TS 23.038 [4] with bit 8 set to 0. The text length given by 
the UICC shall state the number of characters in the text string. The ME shall pack the text string and modify the Data 
Coding Scheme byte to "default alphabet" in accordance with TS 23.038 [4] before submitting the message to the 
network. 

Optionally, the UICC may include in this command an alpha identifier. See ETSI TS 102 223 [32] clause 6.4.10 for the 
use of this alpha identifier. 

If the ME is capable of SMS-MO, then it shall send the data as a Short Message TPDU to the destination address. The 
ME shall give the result to the UICC using TERMINAL RESPONSE (indicating successful or unsuccessful 
transmission of the Short Message) after receiving an SMS RP-ACK or RP -Error from the network. If an alpha 
identifier was provided by the UICC, the ME should not give any information to the user at the reception of SMS RP- 
ACK or RP -Error. 

If the Short Message TPDU is unsuccessfully received by the network (e.g. the reception of a CP -ERROR), the ME 
shall inform the UICC using TERMINAL RESPONSE (network currently unable to process command). If a null alpha 
identifier was provided by the UICC, the ME should not give any information to the user at the unsuccessful network 
reception. 

6.4.11 SENDSS 

Upon receiving this command, the ME shall decide if it is able to execute the command. Examples are given below, but 
the list is not exhaustive: 

if the command is rejected because the ME is busy on an SS transaction, the ME informs the UICC using 
TERMINAL RESPONSE (ME unable to process command - currently busy on SS transaction); 
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if the command is rejected because the ME is busy on a USSD transaction, the ME shall inform the UICC using 
TERMINAL RESPONSE (ME unable to process command - currently busy on USSD transaction); 

if the command is rejected because the ME does not support that Supplementary Service, the ME informs the 
UICC using TERMINAL RESPONSE (Command beyond ME's capabiUties). 

If the ME is able to send the SS request, the ME shall: 

send the SS request immediately, without need to alert the user first; 

optionally, the UICC may include in this command an alpha-identifier. The use of this alpha-identifier by the 
ME is described below: 

if the alpha identifier is provided by the UICC and is not a null data object, the ME shall use it to inform the 
user. This is also an indication that the ME should not give any other information to the user on the fact that 
the ME is sending a SS request. If an icon is provided by the UICC, the icon indicated in the command may 
be used by the ME to inform the user, in addition to, or instead of the alpha identifier, as indicated with the 
icon qualifier (see clause 6.5.4); 

if the alpha identifier is provided by the UICC and is a null data object (i.e. length = '00' and no value part), 
this is an indication that the ME should not give any information to the user on the fact that the ME is 
sending an SS request; 

if the alpha identifier is not provided by the UICC, the ME may give information to the user concerning what 
is happening. 

once an SS Return Result message not containing an error has been received from the network, the ME shall 
inform the UICC that the command has been successfully executed, using TERMINAL RESPONSE. This 
command shall include the contents of SS Return Result as additional data. 

If a null alpha identifier was provided by the UICC, the ME should not give any information to the user at the 
reception of an SS Return Result message; 

if the command is rejected because the network cannot support or is not allowing the Supplementary Service 
request, the ME informs the UICC using TERMINAL RESPONSE (SS Return Result error code). 
If a null alpha identifier was provided by the UICC, the ME should not give any information to the user at the 
reception of a SS Return Result message; 

if the SS request is unsuccessfully received by the network, the ME shall inform the UICC using TERMINAL 
RESPONSE (network currently unable to process command), and not retry to send the request. 
If a null alpha identifier was provided by the UICC, the ME should not give any information to the user at the 
reception of a SS Return Result message. 

A terminal of type ND shall ignore any alpha identifier provided together with this command. The terminal shall 
respond with "command performed successfully" upon successful completion of the command. A terminal of type ND 
shall also ignore any icon provided together with this command. The terminal shall respond with "command performed 
successfully but requested icon could not be displayed" upon successful completion of the command. 

If the ME supports the Last Number Dialled service, the ME shall not store in EFlnd the supplementary service control 
string sent by the UICC in this command. 

The supplementary service control string included in the SEND SS proactive command shall not be checked against 
those of the FDN list, even if the Fixed Dialling Number service is enabled. 

6.4.12 SEND USSD 

6.4.12.1 MM I Mode 

Upon receiving this command, the ME shall decide if it is able to execute the command. Examples are given below, but 
the list is not exhaustive: 

if the command is rejected because the ME is busy on a USSD transaction, the ME informs the UICC using 
TERMINAL RESPONSE (ME unable to process command - currently busy on USSD transaction); 
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if the command is rejected because the ME is busy on a SS transaction, the ME informs the UICC using 
TERMINAL RESPONSE (ME unable to process command - currently busy on SS transaction). 

If the ME is able to send the USSD request, the ME shall: 

send the USSD immediately, without need to alert the user first; 

optionally, the UICC may include in this command an alpha-identifier. The use of this alpha-identifier by the 
ME is described below: 

if the alpha identifier is provided by the UICC and is not a null data object, the ME shall use it to inform the 
user. This is also an indication that the ME should not give any other information to the user on the fact that 
the ME is sending a USSD request. If an icon is provided by the UICC, the icon indicated in the command 
may be used by the ME to inform the user, in addition to, or instead of the alpha identifier, as indicated with 
the icon qualifier (see clause 6.5.4); 

if the alpha identifier is provided by the UICC and is a null data object (i.e. length = '00' and no value part), 
this is an indication that the ME should not give any information to the user on the fact that the ME is 
sending a USSD request; 

if the alpha identifier is not provided by the UICC, the ME may give information to the user concerning what 
is happening. 

A terminal of type ND shall ignore any alpha identifier provided together with this command. The terminal shall 
respond with "command performed successfully" upon successful completion of the command. A terminal of 
type ND shall also ignore any icon provided together with this command. The terminal shall respond with 
"command performed successfully but requested icon could not be displayed" upon successful completion of the 
command. 

once the USSD transaction is initiated, a dialogue between the network and the user may occur which involves 
the MMI of the ME. If an alpha identifier was initially provided by the UICC, this alpha identifier may be 
discarded during this dialogue; 

once a RELEASE COMPLETE message containing the USSD Return Result message not containing an error 
has been received from the network, the ME shall inform the UICC that the command has been successfully 
executed, using TERMINAL RESPONSE. This command shall include the text contained in the USSD Return 
Result in a Text String data object. If a null alpha identifier was provided by the UICC, the ME should not give 
any information to the user at the reception of a USSD Return Result message; 

if the UE clears the transaction by sending a RELEASE COMPLETE upon request of the user, the ME shall 
inform the UICC using TERMINAL RESPONSE (USSD transaction terminated by user); 

if the USSD operation is rejected because the network cannot support or is not allowing mobile initiated USSD, 
the ME informs the UICC using TERMINAL RESPONSE (USSD Return Result error code). If a null alpha 
identifier was provided by the UICC, the ME should not give any information to the user at the reception of a 
USSD Return Result message; 

if the USSD request is unsuccessfully received by the network, the ME shall inform the UICC using 
TERMINAL RESPONSE (network currently unable to process command), and not retry to send the request. If a 
null alpha identifier was provided by the UICC, the ME should not give any information to the user at the 
reception of a USSD Return Result message. 

6.4.12.2 Application Mode 

This clause applies if class "p" is supported. 

A USSD is considered as Application Mode (Send USSD used for the transport of Data to the network) if the service 
"data download via USSD and USSD application mode" is allocated and activated in the USIM Service Table (see 
TS 3L102 [14]) and the DCS coding within the USSD string TLV is set to 8 bit data. 

Upon receiving this command, the ME shall decide if it is able to execute the command. Examples are given below, but 
the list is not exhaustive: 

if the command is rejected because the ME is busy on a USSD transaction, the ME informs the UICC using 
TERMINAL RESPONSE (ME unable to process command - currently busy on USSD transaction); 
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if the command is rejected because the ME is busy on a SS transaction, the ME informs the UICC using 
TERMINAL RESPONSE (ME unable to process command - currently busy on SS transaction). 

If the ME is able to send the USSD request then the ME shall: 

send the USSD immediately, without need to alert the user first; 

optionally, the UICC may include in this command an alpha-identifier. The use of this alpha-identifier by the 
ME is described below: 

if the alpha identifier is provided by the UICC and is not a null data object, the ME shall use it to inform the 
user. This is also an indication that the ME should not give any other information to the user on the fact that 
the ME is sending a USSD request. If an icon is provided by the UICC, the icon indicated in the command 
may be used by the ME to inform the user, in addition to, or instead of the alpha identifier, as indicated with 
the icon qualifier (see clause 6.5.4); 

if the alpha identifier is provided by the UICC and is a null data object (i.e. length = '00' and no value part), 
this is an indication that the ME should not give any information to the user on the fact that the ME is 
sending a USSD request; 

if the alpha identifier is not provided by the UICC, the ME may give information to the user concerning what 
is happening. 

once a FACILITY (including RELEASE COMPLETE) message containing a USSD Request message has been 
received from the network, the ME shall inform the UICC that the network requests more information , using 
the command ENVELOPE (USSD Data Download). This command shall include the text contained in the 
USSD Request in a Text String data object. If a null alpha identifier was provided by the UICC, the ME should 
not give any information to the user at the reception of a USSD Request message. 

A terminal of type ND shall ignore any alpha identifier provided together with this command. The terminal shall 
respond with "command performed successfully" upon successful completion of the command. A terminal of type ND 
shall also ignore any icon provided together with this command. The terminal shall respond with "command performed 
successfully but requested icon could not be displayed" upon successful completion of the command. 

6.4.13 SET UP CALL 

This command is issued by the UICC to request a call set up. The procedure is defined in ETSI TS 102 223 [32] clause 
6.4.13, except when stated otherwise in the present document. 

The UICC may request the use of an automatic redial mechanism according to TS 22.001 [22] 

In addition to the rules given in ETSI TS 102 223 [32] clause 6.4.13 the following applies: 

If the UICC supplies a number stored in EFecc, this shall not result in an emergency call. 

Upon receiving this command, the ME shall decide if it is able to execute the command. Examples are given below, but 
the list is not exhaustive: 

if the command is rejected because the ME is busy on another call, the ME informs the UICC using TERMINAL 
RESPONSE (ME unable to process command - currently busy on call); 

if the command is rejected because the ME is busy on a SS transaction, the ME informs the UICC using 
TERMINAL RESPONSE (ME unable to process command - currently busy on SS transaction); 

if the command is rejected because the ME cannot support Call Hold, or because the ME does not support the 
capability configuration parameters requested by the UICC, the ME informs the UICC using TERMINAL 
RESPONSE (Command beyond ME's capabiHties); 

if the command is rejected because the network cannot support or is not allowing Call Hold of a multi party call, 
the ME informs the UICC using TERMINAL RESPONSE (SS Return Result error code); 

if the command is rejected because the network cannot support or is not allowing Call Hold of a single call, the 
ME informs the UICC using TERMINAL RESPONSE (Network currently unable to process command). 
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If the ME supports the Outgoing Call Information service, the ME shall not store in EFqci and in EFqct the call set-up 
details (called party number and associated parameters) sent by the UICC in this command. 

6.4.14 POLLING OFF 

See ETSI TS 102 223 [32] clause 6.4.14. 

6.4.15 PROVIDE LOCAL INFORMATION 

This command requests the ME to send current local information to the UICC. At present, this information is restricted 
to: 

location information: the mobile country code (MCC), mobile network code (MNC), location area code/tracking 
area code (LAC/TAC) and cell ID of the current serving cell; 

NOTE: For UTRAN the cell ID returned in terminal response is the last known cell ID which may not be the 
current serving cell, when the ME is on a dedicated channel. 

- the IMEI or IMEIS V of the ME; 

the Network Measurement Results (and the BCCH channel list if connected to GERAN); 

the current date, time and time zone; 

the current ME language setting; 

the Timing Advance, suitable only for GERAN; 

- the current access technology; 

- the current network search mode; 

- the charge state of the battery (if class "g" is supported); 

- the WSID of the current I-WLAN connection; 

- The CSG ID list and corresponding HNB names (if available in the broadcasted information to the ME) of 

detected CSG or Hybrid cells in the Allowed CSG list or the Operator CSG list (if class "q" is supported); 

- The H(e)NB IP address, (if class "v" is supported); 

- The list of location information for surrounding macrocells (if class "w" is supported). 

The above information can be requested only if supported by the ME as indicated in the TERMINAL PROFILE. 

The ME shall return the requested local information within a TERMINAL RESPONSE. 

Where location information or Network Measurement Results has been requested and no service is currently available, 
then the ME shall return TERMINAL RESPONSE (ME currently unable to process command - no service). 

Where location information or Network Measurement Results has been requested and the ME is on limited service (e.g. 
emergency calls only), the ME shall return the data requested in the TERMINAL RESPONSE with the general result 
(Limited Service). 

Where Network Measurement Results has been requested and the ME is connected to a different access technology to 
the one requested (e.g. UTRAN Measurement Qualifier included when ME is connected to a GERAN), then the ME 
shall return TERMINAL RESPONSE (ME currently unable to process command - no service). 

Network Measurement Results are available on a per access technology basis and indicated as such in the Terminal 
Profile. 

Network Measurement Results for a GERAN: 
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If the NMR are requested and a call is in progress, the value of all the returned parameters provided by the 
ME in the response to the command will be valid. The NMR returned when a call is in progress from Mes 
supporting multiband operation, shall be according to the value of the multiband reporting parameter as 
defined in TS 44.018 [27]. If a call is not in progress (i.e. ME is in idle mode) some of the returned 
parameters (e.g. RXQUAL) may be invalid. In idle mode, Mes supporting multiband operation shall ignore 
the value of the multiband reporting parameter and the NMR returned shall be as defined in TS 44.018 [27] 
when the multiband reporting parameter equals zero. 

NOTE 1 : When in idle mode, the only information element on which it is possible to rely on is the 

RXLEV-FULL-SERVING-CELL, which contains the value of the received signal strength on 
the BCCH of the current serving cell. 

NOTE 2: Network Measurement Results are defined in TS 44.018 [27] as Measurement Results. 

The BCCH channel list is only available if the ME is connected to a GERAN. 

Network Measurement Results for a UTRAN: 

The USIM request for measurement information shall not trigger any measurement activities in ME in 
addition to those requested by UTRAN. 

The ME shall only report measurement results that are valid according to the current RRC state or the 
UTRAN configuration requested. 

NOTE 3: The returned parameters provided by the ME, in the response to the command, are subject to the 
ME capability, currently used radio configuration, current RRC state and the UTRAN 
configuration requested as defined in the TS 25.331 [38]. 

NOTE 4: Network Measurement Results are defined in TS 25.331 [38] as the MEASUREMENT 
REPORT message. 

Network Measurement Results for a E-UTRAN: 

The USIM request for measurement information shall not trigger any measurement activities in ME in 
addition to those requested by E-UTRAN. 

The ME shall only report measurement results that are valid according to the current RRC state or the E- 
UTRAN configuration requested. 

NOTE 5: The returned parameters provided by the ME, in the response to the command, are subject to the 
ME capability, currently used radio configuration, current RRC state and the E-UTRAN 
configuration requested as defined in the TS 36.331 [49]. 

NOTE 6: Network Measurement Results are defined in TS 36.331 [49] as the MeasurementReport 
message. 

The ME shall return the current date and time as set by the user. If available, the ME shall also return the time zone 
known from the network with the NITZ feature (see TS 22.042 [3]). If the time zone information is not available, the 
ME shall return 'FF' for this element. 

If language setting is requested, the ME shall return the currently used language. 

Timing advance is only available if the ME is connected to a GERAN. If the Timing Advance is requested, the ME 
shall return the timing advance value that was received from the BTS during the last active dedicated connection (e.g. 
for call or SMS). Timing advance is defined in TS 44.018 [27]. An ME supporting the Timing Advance feature shall be 
able to store the last value of timing advance. In addition to the timing advance value, the ME shall return its current 
status (i.e. ME is in idle mode or not) in order for the application to be aware of potential misinterpretation of the timing 
advance value. Caution should be taken if using the Timing Advance value for distance measurement as reflections 
from the external environment (buildings etc.) may affect the accuracy. 

If the access technology is requested, the ME shall return the current access technology that the ME is using. 

The WSID is only available if the ME is connected to a I-WLAN. If the WSID is requested, the ME shall return the 
WSID of the currently connected I-WLAN. Where a WSID has been requested and no I-WLAN is currently connected, 
then the ME shall return TERMINAL RESPONSE (ME currently unable to process command - no service). 
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When CSG ID list is requested, the ME shall return the CSG ID list and the corresponding HNB name (if available in 
the broadcasted information to the ME). If the CSG ID list has been requested, and the ME is currently not camped on a 
CSG or Hybrid cell, the ME shall return TERMINAL RESPONSE (ME currently not able to process command - no 

service). 

The proactive command PROVIDE LOCAL INFORMATION - H(e)NB IP address is issued on the H(e)NB-HPSIM 
interface, see TS 3L104 [56]. 

When the IP address is requested, the H(e)NB shall return the IP address reported to H(e)MS and/or HNB-GW for 
location verification based on IP address (which may be a local IP address). If no such IP address is available to the 
H(e)NB, the H(e)NB shall return TERMINAL RESPONSE (ME currently not able to process command - no service). 
If several such IP addresses are available, the H(e)NB provides all of them to the UICC. 

The proactive command PROVIDE LOCAL INFORMATION - H(e)NB surrounding macrocell is issued on the 
H(e)NB-HPSIM interface, see TS 3L104 [56]. 

When the list of surrounding macrocells is requested, the H(e)NB shall provide the list of location information for 
detected macrocells. 

For the HNB, all cell information contained in: intra-frequency neighbor list, inter-frequency neighbor list, 
inter-RAT neighbor Hst, that are reported to the HMS, see TS 32.582 [57] sec 6.LL 

For the HeNB, all cell information contained in: LTE cell neighbor list, UMTS cell neighbor list, GSM cell 
neighbor list, that are reported to the HeMS, see TS 32.592 [58] sec 6.L15. 

Location information contains the mobile country code (MCC), mobile network code (MNC), location area 
code/tracking area code (LAC/TAC) and cell ID. The list of surrounding macrocells is provided for all access 
technologies supported by the H(e)NB, up to the hmit of the TERMINAL RESPONSE APDU command size. 

Note: the HPSIM request for H(e)NB surrounding macrocell does not trigger a network scan; the H(e)NB reports 
available information to the HPSIM. 

6.4.16 SET UP EVENT LIST 

See ETSI TS 102 223 [32] clause 6.4.16. 

6.4.1 7 PERFORM CARD APDU 

See ETSI TS 102 223 [32] clause 6.4.17. 

6.4.18 POWER OFF CARD 

See ETSI TS 102 223 [32] clause 6.4.18. 

6.4.19 POWER ON CARD 

See ETSI TS 102 223 [32] clause 6.4.19. 

6.4.20 GET READER STATUS 

See ETSI TS 102 223 [32] clause 6.4.20. 

6.4.21 TIMER MANAGEMENT 

See ETSI TS 102 223 [32] clause 6.4.21. 

6.4.22 SET UP IDLE MODE TEXT 

See ETSI TS 102 223 [32] clause 6.4.22. 
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6.4.23 RUN AT COMMAND 

See ETSI TS 102 223 [32] clause 6.4.23. 

6.4.24 SEND DTMF 

See ETSI TS 102 223 [32] clause 6.4.24. 

6.4.25 LANGUAGE NOTIFICATION 

See ETSI TS 102 223 [32] clause 6.4.25. 

6.4.26 LAUNCH BROWSER 

This command is used to request a browser inside a browser-enabled ME to interpret the content corresponding to a 
URL. See ETSI TS 102 223 [32] clause 6.4.26. 

Upon receiving this command, the ME shall decide if it is able to execute the command. In addition to the examples 
given in ETSI TS 102 223 [32] clause 6.4.26 the following example applies: 

if the command is rejected because the ME is busy on a SS transaction, the ME informs the UICC using 
TERMINAL RESPONSE (ME unable to process command - ME currently unable to process command); 

6.4.27 OPEN CHANNEL 

6.4.27.1 OPEN CHANNEL related to CS bearer 

This command is issued by the UICC to request a channel opening. The procedure is defined in ETSI TS 102 223 [32] 
clause 6.4.27.1, except when stated otherwise in the present document. 

The UICC may request the use of an automatic reconnection mechanism according to TS 22.001 [22]. 

Upon receiving this command, the ME shall decide if it is able to execute the command. In addition to the examples 
given in ETSI TS 102 223 [32] clause 6.4.27.1 the following example applies: 

if the command is rejected because the ME is busy on a SS transaction, the ME informs the UICC using 
TERMINAL RESPONSE (ME unable to process command - currently busy on SS transaction). The operation is 
aborted. 

The "Bearer description" provided in the command gives recommended values for parameters that the ME should use to 
establish the data link. However if the ME or network does not support these values, the ME selects the most 
appropriate values. 

6.4.27.2 OPEN CHANNEL related to GPRS/UTRAN packet service/E-UTRAN 

The procedures defined in ETSI TS 102 223 [32] clause 6.4.27.2 apply, understanding that: 

"packet data service" means GPRS, UTRAN packet service or E-UTRAN, 

"activation of packet data service" means activation of a PDP context or EPS PDN connection. 

The UICC provides to the terminal a list of parameters necessary to activate a packet data service. The UICC has three 
ways to indicate to the ME the QoS it requires: 

either use a Bearer Description called "Bearer description for GPRS/UTRAN Packet Service/E-UTRAN", which 
is valid for GPRS, UTRAN packet service and E-UTRAN 

or use a Bearer Description called "Bearer description for UTRAN Packet Service with extended parameters and 
HSDPA" which is vaUd for a UTRAN packet service, HSDPA and E-UTRAN. 
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or use a Bearer Description called "Bearer description for E-UTRAN and mapped UTRAN packet service", 
which is valid for UTRAN packet service and E-UTRAN. 

Upon receiving this command, the ME shall decide if it is able to execute the command. In addition to the examples 
given in ETSI TS 102 223 [32] clause 6.4.27.2 the following example applies: 

if the command is rejected because the ME is busy on a SS transaction and unable to activate a PDP context in 
parallel with this SS transaction, the ME informs the UICC using TERMINAL RESPONSE (ME unable to 
process command - currently busy on SS transaction). The operation is aborted. 

The "Bearer description" provided in the command gives recommended values for parameters that the ME should use to 
establish the data link. However if the ME or network does not support these values, the ME selects the most 
appropriate values. 

6.4.27.3 OPEN CHANNEL related to local bearer 

See ETSI TS 102 223 [32] clause 6.4.27.3. 

6.4.27.4 OPEN CHANNEL related to Default (network) Bearer 

See ETSI TS 102 223 [32] clause 6.4.27.4. 

6.4.27.5 OPEN CHANNEL related to l-WLAN bearer 

This clause applies if class "e" is supported. 

Upon receiving this command, the ME shall decide if it is able to execute the command. The UICC shall indicate 
whether the ME should establish the link immediately, in background mode or upon receiving the first transmitted data 
(on demand). 

The UICC provides to the ME a list of parameters necessary to activate a I-WLAN service. 

The ME shall attempt at least one I-WLAN service activation. 

Upon receiving this command, the ME shall decide if it is able to execute the command. Examples are given below, but 
the list is not exhaustive: 

if immediate or background I-WLAN service activation is requested and the ME is unable to set-up a channel 
using the exact parameters provided by the UICC, the ME sets up the channel according to TS 24.234 [42] and 
informs the UICC of the I-WLAN identifier and the modified parameters using TERMINAL RESPONSE 
(Command performed with modification); 

if immediate I-WLAN service activation is requested and the ME is unable to activate the I-WLAN service with 
the network using the exact parameters provided by the UICC, the ME informs the UICC using TERMINAL 
RESPONSE (Network currently unable to process command). The operation is aborted; 

if background mode I-WLAN service activation is requested and the ME is unable to activate the I-WLAN 
service with the network using the exact parameters provided by the UICC, the ME informs the UICC using a 
channel status event (link not established - no further info). The operation is aborted; 

if the command is rejected because the ME has no channel left with the requested bearer capabilities, the ME 
informs the UICC using TERMINAL RESPONSE (Bearer independent protocol error). The operation is aborted; 

- if the user does not accept the channel set-up, the ME informs the UICC using TERMINAL RESPONSE (User 
did not accept the proactive command). The operation is aborted; 

if the user has indicated the need to end the proactive UICC session, the ME informs the UICC using 
TERMINAL RESPONSE (Proactive UICC session terminated by the user). The operation is aborted; 

if background mode I-WLAN service activation is requested, the ME allocates buffers, starts activation of I- 
WLAN service, informs the UICC and reports the channel identifier immediately using TERMINAL 
RESPONSE (Command performed successfully). At the end of activation, the ME shall send a channel status 
event (link established or link not established - no further info). 
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The ME shall inform the UICC that the command has been successfully executed using TERMINAL RESPONSE: 

if immediate I-WLAN service activation is requested, the ME allocates buffers, activates the I-WLAN service 
and informs the UICC and reports the channel identifier using TERMINAL RESPONSE (Command performed 
successfully); 

if on demand I-WLAN service activation is requested, the ME allocates buffers, informs the UICC and reports 
the channel identifier using TERMINAL RESPONSE (Command performed successfully). 

If the ME is able to set up the channel on the serving network, the ME shall then enter the confirmation phase described 
hereafter; optionally, the UICC may include in this command an alpha-identifier. The use of this alpha-identifier by the 
ME is described below: 

if the alpha identifier is provided by the UICC and is not a null data object, the ME shall use it during the user 
confirmation phase. This is also an indication that the ME should not give any other information to the user 
during the user confirmation phase. If an icon is provided by the UICC, the icon indicated in the command may 
be used by the terminal to inform the user, in addition to, or instead of the alpha identifier, as indicated with the 
icon qualifier (see clause 6.5.4); 

if the alpha identifier is provided by the UICC and is a null data object (i.e. length = '00' and no value part), this 
is an indication that the ME should not give any information to the user or ask for user confirmation; 

if the alpha identifier is not provided by the UICC, the ME may give information to the user; 

A terminal of type ND shall ignore any alpha identifier provided together with this command. The terminal shall 
respond with "command performed successfully" upon successful completion of the command. A terminal of 
type ND shall also ignore any icon provided together with this command. The terminal shall respond with 
"command performed successfully but requested icon could not be displayed" upon successful completion of the 
command. 

if the user doesn"t reject the channel, the ME shall then set up a channel. A terminal of type NK or type ND may 
not alert the user and may open the channel without explicit confirmation by the user; 

if the user does not accept the channel or rejects the channel, then the ME informs the UICC using TERMINAL 
RESPONSE (user did not accept the proactive command). The operation is aborted; 

if the user has indicated the need to end the proactive UICC session, the ME shall send a TERMINAL 
RESPONSE with (Proactive UICC session terminated by the user) result value; 

optionally, during packet data service activation, the ME can give some audible or display indication concerning 
what is happening; 

if the user stops the I-WLAN service activation attempt before a result is received from the network, the ME 
informs the UICC using TERMINAL RESPONSE (user cleared down call before connection or network 
release). 

6.4.27.6 OPEN CHANNEL related to Terminal Server Mode 

See ETSI TS 102 223 [32] clause 6.4.27.6. 

6.4.27.7 OPEN CHANNEL related to UICC Server Mode 

See ETSI TS 102 223 [32] clause 6.4.27.5. 

6.4.27.8 OPEN CHANNEL for IMS 

The following applies if classes "e" and "t" are supported. 

After a successful registration to IMS specified in TS 24.229 [52] and after the ME has informed the UICC of this 
successful registration, the UICC may attempt to open a channel to communicate with the IMS. 

The UICC will include in the OPEN CHANNEL for IMS command the lARI representing an active application 
installed on the UICC. This lARI shall be known to the ME and populated in the EFuicciari as specified in TS 31.102 
[14]. 
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The ME shall encapsulate all subsequent SIP communications intended for the IMS application running on the UICC. 
The ME shall decapsulate all subsequent messages received from the IMS application running on the UICC. Once the 
application is no longer available for SIP communications the UICC shall send the CLOSE CHANNEL command for 
the current channel ID. 

If network conditions changed after a successful IMS registration, upon receiving this command, the ME shall decide if 
it is able to execute the command. If the ME is unable to process the command (the list is not exhaustive) 

if the command is unable to proceed due to the absence of an active IMS PDP/PDN context, the ME shall 
inform the UICC using the TERMINAL RESPONSE (network currently unable to process command) upon 
receipt of this failure cause, the UICC shall wait until the next IMS registration event before sending another 
OPEN CHANNEL for IMS command to the ME. 

if the command is unable to proceed due to the inability to contact IMS, the ME shall inform the UICC using 
the TERMINAL RESPONSE (network currently unable to process command) upon receipt of this failure 
cause, the UICC shall wait until the next IMS registration event before sending another OPEN CHANNEL for 
IMS command to the ME. 

If the command is unable to proceed because there is no channel available, the ME shall inform the UICC 
using the TERMINAL RESPONSE (Bearer Independent Protocol error - no channel available). 

The ME shall inform the UICC that the command has been successfully executed using TERMINAL RESPONSE 
(Command performed successfully) 

6.4.28 CLOSE CHANNEL 

ETSI TS 102 223 [32] clause 6.4.28 applies, with the following addition. 

In case of OPEN CHANNEL for IMS, the UICC shall send a CLOSE CHANNEL command to close the BIP channel at 
the end fo the SIP dialog. 

6.4.29 RECEIVE DATA 

See ETSI TS 102 223 [32] clause 6.4.29. 

6.4.30 SEND DATA 

See ETSI TS 102 223 [32] clause 6.4.30. 

6.4.31 GET CHANNEL STATUS 

See ETSI TS 102 223 [32] clause 6.4.31. 

6.4.32 SERVICE SEARCH 

See ETSI TS 102 223 [32] clause 6.4.32. 

6.4.33 GET SERVICE INFORMATION 

See ETSI TS 102 223 [32] clause 6.4.33. 

6.4.34 DECLARE SERVICE 

See ETSI TS 102 223 [32] clause 6.4.34. 

6.4.35 RETRIEVE MULTIMEDIA MESSAGE 

See ETSI TS 102 223 [32] clause 6.4.37. 
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6.4.36 SUBMIT MULTIMEDIA MESSAGE 

See ETSI TS 102 223 [32] clause 6.4.38. 

6.4.37 DISPLAY MULTIMEDIA MESSAGE 

See ETSI TS 102 223 [32] clause 6.4.39. 

6.4.38 SET FRAMES 

See ETSI TS 102 223 [32] clause 6.4.35. 

6.4.39 GET FRAME STATUS 

See ETSI TS 102 223 [32] clause 6.4.36. 

6.4.40 Geographical Location Request 

This clause applies if class "n" is supported. 

This command requests an ME that is equipped with a positioning feature to report the location information of the ME 
within a specified quality of service. 

As the determination of the geographical location information may take some time, the geographical location 
information report is sent by the ME to the UICC using the command ENVELOPE (Geographical Location Reporting). 
The ME reporting can be performed either in the format of GAD shapes defined in TS 23.032 [44] or in the format of 
NMEA sentences defined in lEC 61162-1 [45]. 

The horizontal coordinates represent the minimum set of information to be sent to the UICC (i.e. latitude and 
longitude). The UICC may request additional geographical location information (i.e. vertical coordinate and velocity). 
The UICC may request a preferred quality of service (e.g. preferred accuracy, preferred maximum response time). 
However if the ME does not support the requested preferred parameters, the ME selects the most appropriate quality of 
service parameters. 

Upon receiving this command, the ME shall decide if it is able to execute the command. Examples are given below, but 
the list is not exhaustive: 

if the command is rejected because the ME is not equipped with a positioning feature, the ME informs the UICC 
using TERMINAL RESPONSE (Command beyond ME's capabiUties); 

if the command is rejected because the ME is currently unable to get the location information (e.g. due to lack of 
GPS coverage or due to a deactivated GPS receiver), the ME shall inform the UICC using TERMINAL 
RESPONSE (ME currently unable to process command); 

If the ME is able to attempt to retrieve the geographical location information, the ME shall: 

inform the UICC that the command has been successfully executed, using TERMINAL RESPONSE. 

once the requested location information is available, the ME shall send this information to the UICC using the 
command ENVELOPE (Geographical Location Reporting). 

optionally, the UICC may include in this command an alpha-identifier. The use of this alpha-identifier by the 
ME is described below: 

if the alpha identifier is provided by the UICC and is not a null data object, the ME shall use it to inform the 
user. This is also an indication that the ME should not give any other information to the user on the fact that 
the ME is processing the location information request for the UICC. If an icon is provided by the UICC, the 
icon indicated in the command may be used by the ME to inform the user, in addition to, or instead of the 
alpha identifier, as indicated with the icon qualifier (see clause 6.5.4); 
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if the alpha identifier is provided by the UICC and is a null data object (i.e. length = '00' and no value part), 
this is an indication that the ME should not give any information to the user on the fact that the ME is 
determining the location information for the UICC; 

A terminal of type ND shall ignore any alpha identifier provided together with this command. The terminal shall 
respond with "command performed successfully" upon successful completion of the command. A terminal of type 
ND shall also ignore any icon provided together with this command. The terminal shall respond with "command 
performed successfully but requested icon could not be displayed" upon successful completion of the command. 

if the alpha identifier is not provided by the UICC, the ME may give information to the user concerning what is 
happening. 

If the ME receives a "Geographical Location Request" command during the processing of a previous "Geographical 
Location Request" command (i.e. after the reception of a location request and before sending the "Geographical 
Location Reporting" ENVELOPE command), the latest location request shall be ignored. 

6.4.41 ACTIVATE 

Not required by 3GPP. 

6.4.42 CONTACTLESS STATE CHANGED 

Not required by 3GPP. 

6.4.43 COMMAND CONTAINER 

Not required by 3GPP. 

6.4.44 ENCAPSULATED SESSION CONTROL 

Not required by 3GPP. 

6.5 Common elements in proactive UICC commands 

See ETSI TS 102 223 [32] clause 6.5. 

6.5.1 Command number 

See ETSI TS 102 223 [32] clause 6.5.1. 

6.5.2 Device identities 

See ETSI TS 102 223 [32] clause 6.5.2. 

6.5.3 Alpha identifier 

See ETSI TS 102 223 [32] clause 6.5.3. 

6.5.4 Icon identifiers 

The display of icons is optional for the terminal on a per command basis, see ETSI TS 102 223 [32] clause 6.5.4. 

6.5.5 Text attribute 

See ETSI TS 102 223 [32] clause 6.5.5. 
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6.5.6 Frame identifier 

See ETSI TS 102 223 [32] clause 6.5.6. 
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6.6 Structure of proactive UICC commands 

The general structure of proactive UICC commands using TLV objects is described in annex C. 

6.6.1 DISPLAY TEXT 

See ETSI TS 102 223 [32] clause 6.6.1. 

6.6.2 GET INKEY 

See ETSI TS 102 223 [32] clause 6.6.2. 

6.6.3 GET INPUT 

See ETSI TS 102 223 [32] clause 6.6.3. 

6.6.4 MORE TIME 

See ETSI TS 102 223 [32] clause 6.6.4. 

6.6.5 PLAY TONE 

See ETSI TS 102 223 [32] clause 6.6.5. 

6.6.6 POLL INTERVAL 

See ETSI TS 102 223 [32] clause 6.6.6. 

6.6.7 SET-UP MENU 

See ETSI TS 102 223 [32] clause 6.6.7. 

6.6.8 SELECT ITEM 

See ETSI TS 102 223 [32] clause 6.6.8. 

6.6.9 SEND SHORT MESSAGE 



Description 


Clause 


M/O/C 


Min 


Length 


Proactive UICC command Tag 


9.2 


M 


Y 


1 


Length (A+B+C+D+E+F+G+H) 


- 


M 


Y 


1 or 2 


Command details 


8.6 


M 


Y 


A 


Device identities 


8.7 


M 


Y 


B 


Alpha identifier 


8.2 





N 


C 


Address 


8.1 





N 


D 


SMS TPDU (SMS-SUBMIT or SMS-COMMAND) 


8.13 


M 


Y 


E 


Icon identifier 


8.31 





N 


F 


Text attribute 


8.70 


C 


N 


G 


Frame Identifier 


8.82 





N 


H 



The address data object holds the RP_Destination_Address of the Service Centre. If no RP_Destination_Address is 
transferred, then the ME shall insert the default Service Centre address. 
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The Text attribute applies to the Alpha Identifier. It may be present only if the Alpha Identifier is present. 

6.6.10 SENDSS 



Description 


Clause 


M/O/C 


Min 


Length 


Proactive UICC command Tag 


9.2 


M 


Y 


1 


Length (A+B+C+D+E+F+G) 


- 


M 


Y 


1 or 2 


Command details 


8.6 


M 


Y 


A 


Device identities 


8.7 


M 


Y 


B 


Alpha identifier 


8.2 





N 


C 


SS string 


8.14 


M 


Y 


D 


Icon identifier 


8.31 





N 


E 


Text attribute 


8.70 


C 


N 


F 


Frame Identifier 


8.82 





N 


G 



The Text attribute applies to the Alpha Identifier. It may be present only if the Alpha Identifier is present. 

6.6.11 SENDUSSD 



Description 


Clause 


M/O/C 


Min 


Length 


Proactive UICC command Tag 


9.2 


M 


Y 


1 


Length (A+B+G+D+E+F+G) 


- 


M 


Y 


1 or 2 


Command details 


8.6 


M 


Y 


A 


Device identities 


8.7 


M 


Y 


B 


Alpha identifier 


8.2 





N 


C 


USSD String 


8.17 


M 


Y 


D 


Icon identifier 


8.31 





N 


E 


Text attribute 


8.70 


C 


N 


F 


Frame Identifier 


8.82 





N 


G 



The Text attribute applies to the Alpha Identifier. It may be present only if the Alpha Identifier is present. 

6.6.12 SET UP CALL 

See ETSI TS 102 223 [32] clause 6.6.12. 

6.6.13 REFRESH 

For all REFRESH modes except "Steering of Roaming", see ETSI TS 102 223 [32] clause 6.6.13. 
For "Steering of Roaming": 



Description 


Clause 


M/O/C 


Min 


Length 


Proactive UICC command Tag 


9.2 


M 


Y 


1 


Length (A+B+C+D+E+F+G+H) 


- 


M 


Y 


1 or 2 


Command details 


8.6 


M 


Y 


A 


Device identities 


8.7 


M 


Y 


B 


Alpha identifier 


8.2 





N 


C 


Icon identifier 


8.31 





N 


D 


Text Attribute 


8.70 


C 


N 


E 


Frame Identifier 


8.82 





N 


F 


PLMNwAcT List 


8.90 


C(see Note 1) 


N 


G 


PLMN List 


8.97 


C (see Note 2) 


N 


H 


Note 1 : This parameter is required in case of steering of roaming (according to TS 23.122 [7]). 
Note 2: This parameter is required in case of steering of roaming for l-WLAN (according to TS 24.234 
[42]). 



The Text attribute apphes to the Alpha Identifier. It may be present only if the Alpha Identifier is present. 
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6.6.14 POLLING OFF 

See ETSI TS 102 223 [32] clause 6.6.14. 

6.6.15 PROVIDE LOCAL INFORMATION 



ETSI TS 131 111 V1 1.3.0 (2012-10) 



Description 


Clause 


M/O/C 


Min 


Length 


Proactive UICC command Tag 


9.2 


M 


Y 


1 


Length (A+B+C) 


- 


M 


Y 


1 or 2 


Command details 


8.6 


M 


Y 


A 


Device Identities 


8.7 


M 


Y 


B 


UTRAN/E-UTRAN IVIeasurement Qualifier 


8.73 


C 


N 


C 



UTRAN/E-UTRAN Measurement Qualifier: This data object applies when the Command Qualifier in Command details 
is set to indicate "Network Measurement results". It shall be included to indicate to the ME that "Network Measurement 
Results for a UTRAN" or "Network Measurement Results for a E-UTRAN" is required. It shall be excluded to indicate 
to the ME that "Network Measurement Results for a GERAN" is required. It shall only be included/excluded if the ME 
has indicated that it supports the implied access technology via the respective Terminal Profile setting. 

6.6.16 SET UP EVENT LIST 

See ETSI TS 102 223 [32] clause 6.6.16. 

6.6.17 PERFORM CARD APDU 

See ETSI TS 102 223 [32] clause 6.6.17. 

6.6.18 POWER OFF CARD 

See ETSI TS 102 223 [32] clause 6.6.18. 

6.6.19 POWER ON CARD 

See ETSI TS 102 223 [32] clause 6.6.19. 

6.6.20 GET READER STATUS 

See ETSI TS 102 223 [32] clause 6.6.20. 

6.6.21 TIMER MANAGEMENT 

See ETSI TS 102 223 [32] clause 6.6.21. 

6.6.22 SET UP IDLE MODE TEXT 

See ETSI TS 102 223 [32] clause 6.6.22. 

6.6.23 RUN AT COMMAND 

See ETSI TS 102 223 [32] clause 6.6.23. 

6.6.24 SEND DTMF COMMAND 

See ETSI TS 102 223 [32] clause 6.6.24. 
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6.6.25 LANGUAGE NOTIFICATION 

See ETSI TS 102 223 [32] clause 6.6.25. 

6.6.26 LAUNCH BROWSER 

See ETSI TS 102 223 [32] clause 6.6.26. 

6.6.27 OPEN CHANNEL 

The structure of the OPEN CHANNEL command is defined in ETSI TS 102 223 [32] clause 6.6.27. , with the addition 
of the following: 



6.6.27.1 



OPEN CHANNEL related to l-WLAN Bearer 



Description 


Clause 


M/O/C 


Min 


Length 


Proactive UICC command Tag 


9.2 


M 


Y 


1 


Length (A+B+C+D+E+F+G+H+l+J+K+L) 


- 


M 


Y 


1 or 2 


Command details 


8.6 


M 


Y 


A 


Device identities 


8.7 


M 


Y 


B 


Alpha identifier 


8.2 





N 


C 


Icon identifier 


8.31 





N 


D 


Bearer description 


8.52 


M 


Y 


E 


Buffer size 


8.55 


M 


Y 


F 


l-WLAN Identifier 


8.83 





N 


G 


Other address (local address) 


8.58 





N 


H 


UlCC/terminal interface transport level 


8.59 





N 


1 


Data destination address 


8.58 


C 


Y 


J 


Text Attribute 


8.72 


C 


N 


K 


Frame Identifier 


8.82 





N 


L 



The I-WLAN Identifier may be requested. If the parameter is not present, the ME shall select the I-WLAN according to 
TS 24.234 [42] using the Automatic PLMN Selection Mode Procedure. 

The local address parameter provides information to the ME necessary to identify the local device. If the parameter is 
present and length is not null, it provides an IP address that identifies the USAT application in the address area 
applicable to the PDN. If local address length is null, dynamic local address allocation is required for the USAT 
application. If parameter is not present, the ME may use the ME default local address configuration. 

If the UICC/ME interface transport level is present in the command, then the ME shall provide the requested transport 
layer protocols under the channel and shall use this object containing a set of parameters required to make the transport 
connection. The data that is exchanged at the UICC/ME interface in the RECEIVE DATA/SEND DATA commands are 
SDUs. When the USAT application sends an SDU, the transport layer within the ME is in charge to add the transport 
header to the SDU in order to build the Transport-PDU. When the USAT application requests to receive an SDU, the 
transport layer within the ME is in charge to remove the transport header of the Transport-PDU, and to forward the 
SDU to the USAT. If the parameter is not present, the UICC/ME interface is the bearer level (serial link or packet link), 
and the USAT application is in charge of the network and transport layer. 

The Data destination address is the end point destination address of sent data. This data destination address is requested 
when a UICC/ME interface transport is present, otherwise it is ignored. The data destination address is a data network 
address (e.g. IP address). 

Text Attribute applies to the Alpha Identifier. It may be present only if the Alpha Identifier is present. 
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6.6.27.2 



OPEN CHANNEL for IMS 



Description 


Clause 


M/O/C 


Min 


Length 


Proactive UICC command Tag 


9.2 


M 


Y 


1 


Length (A+B+C+D) 


- 


M 


Y 


1 or 2 


Command details 


8.6 


M 


Y 


A 


Device identities 


8.7 


M 


Y 


B 


Buffer size 


8.55 


M 


Y 


C 


lARI 


8.110 


M 


Y 


D 



6.6.28 CLOSE CHANNEL 

See ETSI TS 102 223 [32] clause 6.6.28. 

6.6.29 RECEIVE DATA 

See ETSI TS 102 223 [32] clause 6.6.29. 

6.6.30 SEND DATA 

See ETSI TS 102 223 [32] clause 6.6.30. 

6.6.31 GET CHANNEL STATUS 

See ETSI TS 102 223 [32] clause 6.6.31. 

6.6.32 SERVICE SEARCH 

See ETSI TS 102 223 [32] clause 6.6.32. 

6.6.33 GET SERVICE INFORMATION 

See ETSI TS 102 223 [32] clause 6.6.33. 

6.6.34 DECLARE SERVICE 

See ETSI TS 102 223 [32] clause 6.6.34. 

6.6.35 RETRIEVE MULTIMEDIA MESSAGE 

See ETSI TS 102 223 [32] clause 6.6.37. 

6.6.36 SUBMIT MULTIMEDIA MESSAGE 

See ETSI TS 102 223 [32] clause 6.6.38. 

6.6.37 DISPLAY MULTIMEDIA MESSAGE 

See ETSI TS 102 223 [32] clause 6.6.39. 

6.6.38 SET FRAMES 

See ETSI TS 102 223 [32] clause 6.6.35. 
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6.6.39 GET FRAMES STATUS 

See ETSI TS 102 223 [32] clause 6.6.36. 

6.6.40 Geographical Location Request 



ETSI TS 131 111 V1 1.3.0 (2012-10) 



Description 


Clause 


M/O/C 


Min 


Length 


Proactive UICC command Tag 


9.2 


M 


Y 


1 


Length (A+B+C+D+E) 


- 


M 


Y 


1 or 2 


Command details 


8.6 


M 


Y 


A 


Device Identities 


8.7 


M 


Y 


B 


Alpha identifier 


8.2 





N 


C 


Icon identifier 


8.31 





N 


D 


Geographical Location Parameters 


8.94 


M 


N 


E 



6.6.41 ACTIVATE 

Not required by 3GPP. 

6.6.42 CONTACTLESS STATE CHANGED 

Not required by 3GPP. 

6.6.43 COMMAND CONTAINER 

Not required by 3GPP. 

6.6.44 ENCAPSULATED SESSION CONTROL 

Not required by 3GPP. 



6.7 Command results 

Once the ME has made its attempt to execute a proactive command from the UICC, the ME shall inform the UICC of 
the success or otherwise of that command, by using TERMINAL RESPONSE. 

This procedure is defined in ETSI TS 102 223 [32] clause 6.7, and applies here except for the following statements. 

Temporary problems are defined as: 

ME is currently unable to process the command. Specific causes for this are listed in ETSI TS 102 223 [32] 
clause 6.7; in addition to these, the following causes may be returned within the USAT context: 

ME currently busy on SS transaction; 

ME currently busy on USSD operation; 

access control class barred on serving network; 

if none of these can be made to apply, a "no cause can be given" value can be used; 

network is currently unable to process the command. Within the USAT context, specific cause values are the 
cause values given by the network, as defined in TS 24.008 [9]; 
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in some proactive commands, the ME is required to solicit and receive approval of the user before executing the 
proactive command. In the case that the user does not give approval for the execution of the proactive command, 
it shall not be executed by the ME and the terminal response 'user did not accept the proactive command' shall be 
returned by the ME to the UICC; 

the user cleared down the call, before the call connected (CONNECT received from network, as defined in 
TS 24.008 [9]) or before the network released the call; 

action in contradiction with the current timer state. This is where the UICC requests an action for a timer to be 
taken by the ME and the state of the timer does not allow that action; 

interaction with call control by UICC, temporary problem. This is sent by the ME to indicate that call control 
modified the type of request indicated in the proactive command, and that the action requested by call control 
encounters a temporary problem. 

Permanent problems are defined as in ETSI TS 102 223 [32] clause 6.7, with the addition of: 

SS Return Error. This is given to the UICC when the network returns a SS error in response to a previous SS 
command. Specific cause values are the same as given by the network in the Return Error message; 

USSD Return Error. This is given to the UICC when the network returns a USSD error in response to a previous 
USSD command. Specific cause values are the same as given by the network in a Return Error message; 

SMS RP -ERROR. This is given to the UICC when the network returns an error in response to the ME trying to 
send a short message. Specific cause values are the same as the cause value of RP -Cause in an RP-ERROR 
message; 

interaction with MO short message control by USIM, permanent problem. This is sent by the ME to indicate 
that: 

MO short message control by USIM does not allow the action corresponding to the proactive command; or 

MO short message control by USIM has modified the type of request indicated in the proactive command and 
that the action requested by call control encounters a permanent problem. 



6.8 



Structure of TERMINAL RESPONSE 



Direction: ME to UICC. 

The command header is specified in TS 31.101 [13]. Length (Ah-Bh- ... H-AA) is indicated by P3 of the header. 

Command parameters/data. 



Description 


Clause 


M/O/C 


Min 


Length 


Command details 


8.6 


M 


Y 


A 


Device identities 


8.7 


M 


N 


B 


Result 


8.12 


M 


Y 


C 


Duration (only required in response to a 
POLL INTERVAL proactive command) 


8.8 


C 


N 


D 


Text string (only required in response to a 
GET INKEY or GET INPUT or SEND USSD 
proactive command) 


8.15 


C 


N 


E 


Item identifier (only required in response to 
SELECT ITEM proactive command) 


8.10 


C 


N 


F 


Local information (only required in response 
to PROVIDE LOCAL INFORMATION 
proactive command) 


8.19,8.20, 
8.22, 8.29, 
8.39, 8.45, 
8.46, 8.62, 
8.83, 8.85, 
8.86, 8.87, 
8.100,8.116, 
8.117 


C 


N 


G 


Call control requested action (only required if 
call control by USIM has modified a proactive 
command SET UP CALL, SEND SS or 


8.30 


C 


N 


H 
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Description 


Clause 


M/O/C 


Min 


Length 


SEND USSD in another type of request). 










Result data object 2 (only required if call 
control by USIIVI has modified a proactive 
command SET UP CALL, SEND SS or 
SEND USSD in another type of request). 


8.12 


C 


N 


1 


Card reader status (only required in 
response to GET READER STATUS 
command). According to the requested 
information, one Card reader status object 
for each card interface reported, or one Card 
reader identifier object is required.. 


8.33, 8.57 


c 


N 


Jo + ... + Jn 

or J 


Card ATR (only required in response to 
POWER ON CARD). 


8.34 


c 


N 


K 


R-APDU (only required in response to 
PERFORM CARD APDU). 


8.36 


c 


N 


L 


Timer identifier (only required in response to 
a TIMER MANAGEMENT proactive 
command) 


8.37 


c 


N 


M 


Timer value (only required in response to a 
TIMER MANAGEMENT proactive command) 


8.38 


c 


N 


N 


AT Response (only required in response to 
RUN AT COMMAND proactive command) 


8.41 


c 


N 


P 


Text string2 (only required if call control by 
USIM has modified the proactive command 
SET UP CALL or SEND SS into a USSD 
request) 


8.15 


c 


N 





Channel data (only required in response to 
RECEIVE DATA) 


8.53 


c 


N 


R 


Channel status (only required in response to 
GET CHANNEL STATUS or OPEN 
CHANNEL proactive command) 


8.56 


c 


N 


So+ ... +Sn 


Channel data length (only required in 
response to RECEIVE DATA or SEND DATA 
proactive command) 


8.54 


c 


N 


T 


Bearer description (only required in response 
to OPEN CHANNEL proactive command) 


8.52 


c 


N 


U 


Buffer size (only required in response to 
OPEN CHANNEL proactive command) 


8.55 


c 


N 


V 


Total display duration (only required in 
response to a GET INKEY proactive 
command) 


8.8 


c 


N 


w 


Service availability (only required in response 
to SERVICE SEARCH proactive command) 


8.68 


c 


N 


X 


Service record (only required in response to 
GET SERVICE INFORMATION proactive 
command) 


8.64 


c 


N 


Y 


Other address (local address) (only required 
in response to OPEN CHANNEL proactive 
command with dynamic local address 
request) 


8.58 


c 


N 


z 


Frames Information (only required in 
response to SET FRAMES or GET FRAMES 
STATUS proactive commands) 


8.81 


c 


N 


AA 



Specific rules apply for the coding of the TERMINAL RESPONSE, see ETSI TS 102 223 [32] clause 6. 
Response parameters/data: None. 

6.8.1 Command details 

See ETSI TS 102 223 [32] clause 6.8.1. 
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6.8.2 Device identities 

See ETSI TS 102 223 [32] clause 6.8.2. 

6.8.3 Result 

See ETSI TS 102 223 [32] clause 6.8.3. 

6.8.4 Duration 

See ETSI TS 102 223 [32] clause 6.8.4. 

6.8.5 Text string 

ETSI TS 102 223 [32] clause 6.8.5 applies, with the addition of the following procedure. 

When the ME issues a successful TERMINAL RESPONSE for a SEND USSD command, it shall supply the text 
returned within the Return Result message from the network, no matter what type of string was returned. 

6.8.6 Item identifier 

See ETSI TS 102 223 [32] clause 6.8.6. 

6.8.7 Local information 

For Local Information values defined in clause 8.6 then ETSI TS 102 223 [32] clause 6.8.7 applies, with the addition of 
the following procedures: 

- Where the UICC has requested the Network Measurement Results, the TERMINAL RESPONSE shall contain 

- for GERAN: The NMR data object and the BCCH channel list data object 

- for UTRAN: The Network Measurement Results are coded as the MEASUREMENT REPORT message as 
defined in TS 25.331 [38]. 

for E-UTRAN: The Network Measurement Results are coded as the MeasurementReport message defined in 
TS 36.331 [49] 

- Where the UICC has requested the WLAN Specific Identifier, the TERMINAL RESPONSE shall contain the 
WSID of the current I- WLAN connection. 

- Where the UICC has requested the CSG ID list Identifier, the TERMINAL RESPONSE shall contain the CSG 
ID list and the corresponding HNB name (if available in the broadcasted information to the ME) of the detected 
CSG or Hybrid cells in the Allowed CSG list or the Operator CSG list, (if class "q" is supported) 

- Where the UICC has requested the H(e)NB IP address, the TERMINAL RESPONSE shall contain the list of all 
IP addresses available on the H(e)NB -network interface, (if class "v" is supported) 

Where the UICC has requested the list of surrounding macrocells, the TERMINAL RESPONSE shall contain, 
for all supported access technologies, the Access Technology data object followed by one location information 
data object per surrounding macrocell detected, up to the limit of the TERMINAL RESPONSE APDU command 
size. If no macrocell is detected for an access technology, a location information data object with length shall 
be present. 



6.8.8 Call control requested action 

When the ME issues a TERMINAL RESPONSE for a proactive command SET UP CALL, SEND SS or SEND USSD 
which has been modified by call control by UICC in another type of request, it shall supply the response data given in 
response to the ENVELOPE (CALL CONTROL). 
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6.8.9 Result data object 2 

When the ME issues a TERMINAL RESPONSE for a proactive command SET UP CALL, SEND SS or SEND USSD 
which has been modified by call control by UICC in another type of request, it shall supply the Result data object it 
would have supplied for the proactive command equivalent to the action requested by call control, and given in the Call 
control request data element. 

6.8.1 Card reader status 

See ETSI TS 102 223 [32] clause 6.8.10. 

6.8.11 CardATR 

See ETSI TS 102 223 [32] clause 6.8.11. 

6.8.12 R-APDU 

See ETSI TS 102 223 [32] clause 6.8.12. 

6.8.13 Timer identifier 

See ETSI TS 102 223 [32] clause 6.8.13. 

6.8.14 Timer value 

See ETSI TS 102 223 [32] clause 6.8.14. 

6.8.15 AT Response 

See ETSI TS 102 223 [32] clause 6.8.15. 

6.8.16 Text string 2 

When the ME issues a successful TERMINAL RESPONSE for a proactive command SET UP CALL or SEND SS 
which has been modified by "call control" by USIM into a USSD request ('05' result value), it shall supply the Text 
string 2. The Text string 2 shall contain the text returned within the Return Result message from the network for the 
USSD response. Text string 2 is equivalent to the Text string in the Terminal Response to a SEND USSD command. 

6.8.17 Channel data 

See ETSI TS 102 223 [32] clause 6.8.17. 

6.8.18 Channel status 

See ETSI TS 102 223 [32] clause 6.8.18. 

6.8.19 Channel data length 

See ETSI TS 102 223 [32] clause 6.8.19. 

6.8.20 Bearer description 

See ETSI TS 102 223 [32] clause 6.8.20. 
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6.8.21 Buffer size 

See ETSI TS 102 223 [32] clause 6.8.21. 

6.8.22 Total Display Duration 

See ETSI TS 102 223 [32] clause 6.8.22. 

6.8.23 Service Availability 

See ETSI TS 102 223 [32] clause 6.8.23. 

6.8.24 Service Record 

See ETSI TS 102 223 [32] clause 6.8.24. 

6.8.25 Other address (local address) 

See ETSI TS 102 223 [32] clause 6.8.25. 

6.8.26 Frames Information 

See ETSI TS 102 223 [32] clause 6.8.26. 

6.9 Proactive UICC session and ME display interaction 

See ETSI TS 102 223 [32] clause 6.9. 

6.10 Handling of unknown, unforeseen and erroneous messages 

See ETSI TS 102 223 [32] clause 6.10. 

6.1 1 Proactive commands versus possible Terminal response 

Table 6.1 shows for each proactive command the possible terminal response returned (marked by a "•" character), in 
addition to those defined in ETSI TS 102 223 [32] clause 6.11. 

The commands "COMMAND CONTAINER" and "ENCAPSULATED SESSION CONTROL" listed in ETSI TS 102 
223 [32] are not required by 3GPP. 
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Table 6.1 : Proactive commands versus possible terminal response 





PROACTIVE COMMAND 




SET 

UP 

CALL 


SEND 
SS 


SEND 
USSD 


SEND 
SMS 


Geographical 
Location 
Request 










TERMINAL RESPONSE 


■10' 


'11' 


'12' 


'13' 


'16' 










00 
01 


Command performed successfully 

Command performed with partial comprehension 


• 


• 


• 


• 


• 










• 


• 


• 


• 


• 










02 
03 


Command performed, with missing information 
REFRESH performed with additional Efs read 


• 


• 


• 


• 


• 




























04 
05 


Command performed successfully, but requested icon could 

not be displayed 

Command performed, but modified by call control by USIM 


• 


• 


• 


• 


• 










• 




• 














06 
07 


Command performed successfully, limited service 
Command performed with modification 






































08 
09 
10 


REFRESH performed but indicated USIM was not active 
Command performed successfully, tone not played 
Proactive UICC session terminated by the user 






































• 


















11 
12 


Backward move In the proactive UICC session requested by 
the user 

No response from user 




























• 










13 
14 


Help information required by the user 
USSD or SS Transaction terminated by user 




















• 


• 


• 














20 
21 


ME currently unable to process command 
Network currently unable to process command 


• 


• 


• 


• 


• 










• 


• 


• 


• 


• 










22 
23 


User did not accept the proactive command 

User cleared down call before connection or network release 


• 








• 










• 


















24 
25 


Action in contradiction with the current timer state 
Interaction with call control by USIM, temporary problem 




















• 


• 


• 














26 
27 
30 


Launch browser generic error 
MMS Temporary Problem 
Command beyond Mes capabilities 






































• 


• 


• 


• 


• 










31 
32 


Command type not understood by ME 
Command data not understood by ME 


• 


• 


• 


• 


• 










• 


• 


• 


• 


• 










33 
34 


Command number not known by ME 
SS Return Error 


• 


• 


• 


• 


• 










• 


• 
















35 
36 


SMS RPERROR 

Error, required values are missing 








• 












• 


• 


• 


• 


• 










37 

38 


USSD return error 

Multiple Card command error 






• 
































39 
3A 


Interaction with call/SM control by USIM, permanent problem 
Bearer Independent Protocol error 


• 


• 


• 


• 






























3B 
3C 

3D 


Access Technology unable to process command 
Frames error 

MMS Error 




















• 


• 


• 


• 
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7 ENVELOPE Commands 

7.1 Data download to UICC 
7.1.1 SMS-PP data download 
7.1.1.1 Procedure 

If the service "data download via SMS Point-to-point" is allocated and activated in the USIM Service Table (see 
TS 31.102 [14]), then the ME shall follow the procedure below: 

when the ME receives a Short Message with: 

protocol identifier = SIM data download; and 

data coding scheme = class 2 message; or 

when the ME receives a Short Message with: 

protocol identifier=ANSI-136 R-DATA (see TS 23.040 [7]); and 

data coding scheme = class 2 message, and the ME chooses not to handle the message (e.g. Mes not supporting 
EGPRS over TIA/EIA-136 do not need to handle the message). 

- then the ME shall pass the message transparently to the UICC using the ENVELOPE (SMS-PP DOWNLOAD) 
command as defined below; 

the ME shall not display the message, or alert the user of a short message waiting; 

the ME shall wait for an acknowledgement from the UICC; 

When receiving a secured Command Packet (as specified in TS 31.115 [41]) requesting a Proof of Receipt 
(PoR), the UICC shall verify the authenticity of the sender. If the authentication of the sender fails, no further 
processing related to the Proof of Receipt shall take place. 

- if the UICC responds with '90 00' or '6F XX' or '62 XX' or '63 XX', the ME shall acknowledge the receipt of the 
short message to the network using an RP-ACKmessage. The response data from the UICC will be supplied by 
the ME in the TP-User-Data element of the RP-ACK message it will send back to the network (see 

TS 23.040 [5] and TS 24.01 1 [10]). The values of protocol identifier and data coding scheme in RP-ACK shall 
be as in the original message; 

if the UICC responds with '93 00', the ME shall either retry the command or send back an RP-ERROR message 
to the network with the TP-FCS value indicating 'SIM Application Toolkit Busy' (see TS 23.040 [5]). 

If the service "data download via SMS-PP" is not available in the USIM Service Table, and the ME receives a Short 
Message with the protocol identifier = SIM data download and data coding scheme = class 2 message, then the ME 
shall store the message in EFgjyjg in accordance with TS 31.102 [14]. 
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7.1 .1 .2 Structure of ENVELOPE (SMS-PP DOWNLOAD) 

Direction: ME to UICC. 

The command header is specified in TS 31.101 [13]. 

Command parameters/data. 



Description 


Clause 


M/O/C 


MIn 


Length 


SMS-PP download tag 


9.1 


M 


Y 


1 


Length (A+B+C) 


- 


M 


Y 


1 or 2 


Device identities 


8.7 


M 


Y 


A 


Address 


8.1 


M 


N(see 
note 


B 


SMS TPDU (SMS-DELIVER) 


8.13 


M 


Y 





Note: The UICC shall be able to manage the situation when the address field is not present, in 
order to ensure backwards compatibility with previous releases of this specification. 



Device identities: the ME shall set the device identities to: 

source: Network; 

destination: UICC. 

Address: The address data object holds the RP_Originating_Address of the Service Centre (TS-Service-Centre- 
Address), as defined in TS 24.011 [10]. 

Response parameters/data. 

It is permissible for the UICC not to provide response data. If the UICC provides response data, the following data is 
returned. 



Byte(s) 


Description 


Length 


1-X(X<128) 


UICC Acknowledgement 


X 



7.1 .2 Cell Broadcast data download 



7.1.2.1 



Procedure 



If the service "data download via SMS-CB" is available in the USIM Service Table (see TS 31.102 [14]), then the ME 
shall follow the procedure below: 

when the ME receives a new Cell Broadcast message, the ME shall compare the message identifier of the Cell 
Broadcast message with the message identifiers contained in EF^-gjyfjj-,; 

In the case of a GSM Cell Broadcast message, if the message identifier is found in EFCBMID, the cell broadcast 
page is passed to the UICC using the ENVELOPE (CELL BROADCAST DOWNLOAD) command, defined 
below. The ME shall not display the message; 

In the case of a UMTS Cell Broadcast message, if the message identifier is found in EFCBMID, the ME shall 
deconstruct the UMTS Cell Broadcast message Parameter into its Cell Broadcast pages, and reconstruct each 
page in the format of the GSM Cell Broadcast Message Parameter, as described below, and according to the 
definition of the Cell Broadcast message structure in TS 23.041 [6]: 

1) From the Number-of -Pages byte of the UMTS message, the ME shall obtain the number of Cell Broadcast 
pages to be constructed. 

2) For each page the ME shall reconstruct GSM Cell Broadcast Page header as follows: 
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The 2-byte Serial Number of the UMTS message shall be mapped to the reconstructed GSM message 
Serial Number. 

The 2-byte Message ID of the UMTS message shall be mapped to the reconstructed GSM message 
Message ID. 

The 1-byte Data Coding Scheme of the UMTS message shall be mapped to the reconstructed GSM 
message Data Coding Scheme. 

The 1-byte Number-Of-Pages of the UMTS message in combination with the current page"s sequence 
number (based on the order of the pages in the UMTS message) shall be formatted into the reconstructed 
GSM message Page Parameter byte, as described in TS 23.041 [6]. 

The respective 82 byte CBS-Message-Information-Page shall be mapped to the reconstructed GSM 
message content. 

Table: Cell Broadcast Message Parameter Element mapping 



Network -ME (UMTS Cell 
Broadcast Message) 


ME-USAT interface (GSM Cell 
Broadcast Message Format) 


Message ID 


Message ID 


Serial Number 


Serial Number 


Data Coding Scheme 


Data Coding Scheme 


Number-Of -Pages 


Page Parameter (Note) 


CBS-Message-Information-Page 


Content of Message 



NOTE: The Page Parameter byte is constructed from the total number of pages as indicated in the UMTS 
CB message, in combination with the current page"s sequence number (based on the order of the 
pages in the UMTS message). 

- Each of the resulting pages shall then be passed to the UICC using the ENVELOPE (CELL BROADCAST 
DOWNLOAD) command, defined below. The ME shall not display the message; 

if the message identifier of the incoming cell broadcast message is not found in EFCBMID, then the ME shall 
determine if the message should be displayed, by following the procedures in TS 23.041 [6] and TS 31.102 [14]. 

if the UICC responds with '93 00', the ME shall consider that the Cell Broadcast page has not been delivered 
successfully. The ME may retry to deliver the same Cell Broadcast page. 

The ME shall identify new cell broadcast pages by their message identifier, serial number and page values. 

7.1 .2.2 Structure of ENVELOPE (CELL BROADCAST DOWNLOAD) 

Direction: ME to UICC. 

The command header is specified in TS 31.101 [13]. 

Command parameters/data. 



Description 


Clause 


IVI/O/C 


Min 


Length 


Cell Broadcast Download tag 


9.1 


M 


Y 


1 


Length (A+B) 


- 


M 


Y 


1 or 2 


Device identities 


8.7 


M 


Y 


A 


Cell Broadcast page 


8.5 


M 


Y 


B 



Device identities: the ME shall set the device identities to: 
source: Network; 

destination: UICC. 
Response parameters/data: None for this type of ENVELOPE command. 
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7.2 Menu Selection 

See ETSI TS 102 223 [32] clause 7.2. 

If the UICC responds with '93 00', the ME shall not re-issue this particular envelope. 

7.3 Call Control and MO SMS control by USIM 
7.3.1 Call Control by USIM 

7.3.1 .1 Procedure for mobile originated calls 

If the service "call control" is available in the USIM Service Table (see TS 31.102 [14]), then the ME shall follow the 
procedure described in ETSI TS 102 223 [32] clause 7.3.1.1 with the additional rules listed here: 

when the user is dialling "112" or an emergency call code stored in EFecc^ the ME shall set up an emergency call 
instead of passing the call set-up details to the UICC; 

if the UICC provides response data, then in addition to the response data listed by ETSI TS 102 223 [32] clause 
7.3.1.6, the response data from the UICC may indicate to the ME to send instead a supplementary service or 
USSD operation using the data supplied by the UICC. It is then mandatory for the ME to perform the 
supplementary service or USSD operation in accordance with the data from the UICC, if it is within the ME's 
capabilities to do so. If the UICC requires a supplementary service or USSD operation that is beyond the ME's 
capabilities, then the ME shall not perform the supplementary service or USSD operation at all. 

If, as a result of the procedure, the UICC supplies a number stored in EFgcc^ this shall not result in an emergency 
call. 

In the case where the initial call set-up request results from a proactive command SET UP CALL: 

- if the call control result is "not allowed", the ME shall inform the UICC using TERMINAL RESPONSE 

"interaction with call control by UICC or MO short message control by USIM, permanent problem; action not 
allowed"; 

if the call set-up request is changed by call control in a supplementary service or USSD operation, and if the 
supplementary service or USSD operation is within the ME's capabilities, then the ME shall send this request to 
the network. The ME shall then send back a TERMINAL RESPONSE to the SET UP CALL command at the 
same time it would have done for the proactive command equivalent to the action requested by call control 
(i.e. SEND SS or SEND USSD). However, in that case, the TERMINAL RESPONSE shall contain the response 
data given in the response to ENVELOPE (CALL CONTROL) and a second Result TLV identical to the one 
given in response to the proactive command equivalent to the action requested by call control (i.e. SEND SS or 
SEND USSD). The mapping between the general result in the first Result TLV and the general result in the 
second Result TLV is given below: 

the general result "command performed, but modified by call control by USIM" shall be given in the first Result 
TLV if the general result of the second Result TLV is 'OX' or 'IX'; 

the general result "interaction with call control by USIM, temporary problem" shall be given in the first Result 
TLV if the general result of the second Result TLV is '2X'; 

the general result "interaction with call control by USIM or MO short message control by USIM, permanent 
problem" shall be given in the first Result TLV if the general result of the second Result TLV is '3X'; 
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if the call set-up request is changed by call control into a supplementary service or USSD operation, and if the 
supplementary service or USSD operation is beyond the ME's capabilities, then the ME shall send back a 
TERMINAL RESPONSE to the SET UP CALL command, without performing the supplementary service or 
USSD operation at all. In that case, the TERMINAL RESPONSE shall contain the response data given in the 
response to ENVELOPE (CALL CONTROL) and a second Result TLV identical to the one given in response to 
the proactive command equivalent to the action requested by call control (i.e. SEND SS or SEND USSD). The 
mapping between the general result in the first Result TLV and the general result in the second Result TLV is 
given below: 

the general result "interaction with call control by USIM or MO short message control by USIM, permanent 
problem" shall be given in the first Result TLV, and the general result "command beyond ME's capabilities" 
shall be given in the second Result TLV. 

The ME shall then follow the call set-up procedure defined in TS 24.008 [9] or the supplementary service or USSD 
operation procedure defined in TS 24.080 [11]. 

7.3.1 .2 Procedure for Supplementary Services and USSD 

If the service "call control" is available in the USIM Service Table (see TS 31.102 [14]), then for all supplementary 
service and USSD operations (including those resulting from a SEND SS or SEND USSD proactive UICC command), 
the ME shall first pass the supplementary service or USSD control string (corresponding to the supplementary service 
or USSD operation and coded as defined in TS 22.030 [2], even if this SS or USSD operation has been performed via a 
specific menu of the ME) to the UICC, using the ENVELOPE (CALL CONTROL) command defined below. The ME 
shall also pass to the UICC in the ENVELOPE (CALL CONTROL) command the current serving cell. 

The UICC shall respond in the same way as for mobile originated calls. The ME shall interpret the response as follows: 

if the UICC responds with '90 00', the ME shall send the supplementary service or USSD operation with the 
information as sent to the UICC; 

if the UICC responds with any status code indicating an error, the ME shall not send the supplementary service 
or USSD; 

if the UICC responds with '93 00', the ME shall not send the supplementary service or USSD operation and may 
retry the command; 

if the UICC provides response data, then the response data from the UICC shall indicate to the ME whether to 
send the supplementary service or USSD operation as proposed, not send the SS or USSD operation, send the SS 
or USSD operation using the data supplied by the UICC, or instead set up a call using the data supplied by the 
UICC. It is mandatory for the ME to perform the supplementary service or USSD operation or the call set-up 
request in accordance with the data from the UICC, if it is within the ME's capabilities to do so. If the UICC 
requires a call set-up or supplementary service or USSD operation that is beyond the ME's capabilities (e.g. the 
UICC maps a USSD operation to a data call, and the ME does not support data calls), then the ME shall not the 
perform the call set-up request or supplementary service or USSD operation at all. 

In the case where the initial SS or USSD request results from a proactive command SEND SS or SEND USSD: 

- if the call control result is "not allowed", the ME shall inform the UICC using TERMINAL RESPONSE 
("interaction with call control by UICC or MO short message control by UICC, action not allowed"); 

if the SS or USSD request is changed by call control in a call set-up request, then the ME shall set up the call 
using the data given by the UICC, if it is within the ME's capabilities to do so. If the UICC requires a call set-up 
that is beyond the ME's capabilities (e.g. the UICC maps a USSD operation to a data call, and the ME does not 
support data calls), then the ME shall not set up the call at all. The ME shall send back a TERMINAL 
RESPONSE to the initial proactive command at the same time it would have done for the proactive command 
equivalent to the action requested by call control (i.e. SET UP CALL). However, in that case, the TERMINAL 
RESPONSE shall contain the response data given in the response to ENVELOPE (CALL CONTROL) and a 
second Result TLV identical to the one given in response to the proactive command equivalent to the action 
requested by call control (i.e. SET UP CALL). The mapping between the general result in the first Result TLV 
and the general result in the second Result TLV is the same as the one described in clause 7.3.1.1. 

If the ME supports the Last Number Dialled service, the ME shall update EFlnd with the supplementary service or 
USSD control string corresponding to the initial user request. 
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The ME shall then follow the supplementary service or USSD operation procedure defined in TS 24.080 [11] or the call 
set-up procedure defined in TS 24.008 [9]. 

7.3.1 .3 Indication to be given to the user 

The UICC may optionally include an alpha-identifier in the response data to the ENVELOPE (CALL CONTROL) 
message, in order to inform the user at the time the response is received by the ME. The use of this alpha identifier by 
the ME is described below: 

if the UICC responds with "allowed, no modification", then: 

if the alpha identifier is provided by the UICC and is not a null data object, the ME shall use it to inform the user 
during the PDP context activation or call set-up; 

if the alpha identifier is provided by the UICC and is a null data object (i.e. length = '00' and no value part), this 
is an indication that the ME should not modify the display corresponding to the initial user request; 

if the alpha identifier is not provided by the UICC, the ME may give information to the user concerning what is 
happening; 

if the UICC responds with "not allowed", then: 

if the alpha identifier is provided by the UICC and is not a null data object, the ME shall use it to inform the 
user. This is also an indication that the ME should not give any other information to the user on the reason of 
the barring; 

if the alpha identifier is provided by the UICC and is a null data object (i.e. length = '00' and no value part), the 
ME may give information to the user concerning what is happening; 

if the alpha identifier is not provided by the UICC, the ME may give information to the user concerning what is 
happening. 

if the UICC responds with "allowed, with modifications", and the modified request is within the ME's 
capabilities, then: 

if the alpha identifier is provided by the UICC and is not a null data object, the ME shall use it to inform the 
user. The ME shall then not display the destination address or SS string given by the UICC. This is also an 
indication that the ME should not give any other information to the user on the changes made by the UICC to 
the initial user request; 

if the alpha identifier is provided by the UICC and is a null data object (i.e. length = '00' and no value part), this 
is an indication that the ME should not give any information to the user on the changes made by the UICC to 
the initial user request. The ME shall not display the destination address or SS string given by the UICC. The 
ME should not modify the display corresponding to the initial user request; 

if the alpha identifier is not provided by the UICC, the ME may indicate to the user that the initial user request 
has been changed. 

if the UICC responds with "allowed, with modifications" to a user-initiated request (i.e. a request not initiated by 
a proactive command), and the modified user request is beyond the ME's capabilities, then the ME may give 
information to the user on the modified request and the fact that the modified request is beyond the ME's 
capabilities, optionally using the alpha identifier, if one is provided by the UICC; 

if the UICC responds with "allowed, with modifications" to a request by a proactive command SET UP CALL, 
SEND SS, SEND USSD or OPEN CHANNEL where GPRS is selected, and the modified request is beyond the 
ME's capabilities, then the ME shall not give any information to the user on the fact that the modified request is 
beyond the ME's capabilities, and shall give a TERMINAL RESPONSE to the proactive command (i.e. SET UP 
CALL, SEND SS, SEND USSD or OPEN CHANNEL) as detailed in clauses 7.3.1.1, 7.3.1.2 and 7.3.1.3. The 
responsibility to inform the user in this case lies with the UICC application which sent the proactive command. 

A terminal of type ND shall ignore any alpha identifier provided together with the response data to the ENVELOPE 
(CALL CONTROL) message. 
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7.3.1.4 



Interaction with Fixed Dialling Number 



The procedure defined in ETSI TS 102 223 [32] clause 7.3.1.4 for calls applies. In addition, it shall apply in the same 
way for supplementary service operations, the supplementary service control string being checked as if it was a called 
number. 

The ME shall check the number (or the supplementary service control string) in accordance with TS 22.101 [34]. 



7.3.1.5 



Support of Barred Dialling Number (BDN) service 



The procedure defined in ETSI TS 102 223 [32] clause 7.3.1.5 for calls applies. In addition, it shall apply in the same 
way for supplementary service operations, the supplementary service control string being checked as if it was a called 
number. 

The ME shall check the number (or the supplementary service control string) in accordance with TS 22.101 [34]. 

7.3.1 .6 Structure of ENVELOPE (CALL CONTROL) 

Direction: ME to UICC. 

The command header is specified in TS 31.101 [13]. 

Command parameters/data. 



Description 


Clause 


IVI/O/C 


Min 


Length 


Call control tag 


9.1 


M 


Y 


1 


Length (A+B+C+D+E+F) 


- 


M 


Y 


1 or 2 


Device identities 


8.7 


M 


Y 


A 


Address or SB string or USSD string or PDP 
context activation parameters or EPS PDN 
connection activation parameters or IMS 
Request-URI 


8.1,8.14or 

8.1 7 or 8.72 

or 8.98 or 

8.108 


M 


Y 


B 


Capability configuration parameters 1 


8.4 





N 


C 


Subaddress 


8.3 





N 


D 


Location information 


8.19 


M 


N 


E 


Capability configuration parameters 2 


8.4 





N 


F 



Device identities: the ME shall set the device identities to: 

source: ME; 

destination: UICC. 

Address or SS string or USSD string or PDP context activation parameters or EPS PDN connection activation 
parameters or IMS Request-URI: only one data object shall be sent to the UICC: 

for a call set-up, the address data object is used and holds the Called Party Number, as defined in TS 24.008 [9], 
to which the ME is proposing setting up the call; 

for a supplementary service, the SS string data object is used and holds the corresponding supplementary service; 

for a USSD operation, the USSD string data object is used and holds the corresponding USSD control string; 

USIM Applications and Mes should take into account that early implementations of USAT use the SS string data 
object for coding of USSD control strings (instead of the USSD string data object). This behaviour is only 
possible for USSD control strings consisting of digits (0-9,*,#). The UICC can identify Mes having this early 
implementation by evaluating the indication "USSD string data object supported in Call Control" in the 
TERMINAL PROFILE. The ME can identify USIMs having this early implementation by evaluating the 
indication "USSD string data object supported in Call Control" in the USIM Service Table. 

For a PDP context activation, the Activate PDP context request parameters are used, as defined in TS 24.008 [9]; 
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for an EPS PDN connection activation, the PDN Connectivity Request parameters are used, as defined in TS 

24.310 [46]; 

for an IMS communication establishment, the IMS Request-URl is used and holds the SIP URl or tel URI, as 
defined in TS 24.229 [52], to which the ME is proposing setting up the communication. 

Capability configuration parameters: Only used for a call set-up, this contains the Bearer capabilities that the ME 
is proposing to send to the network. The first capability configuration parameters corresponds to the bearer 
capability 1 information element of a mobile originating SETUP message, as defined in TS 24.008 [9]. The 
second capability configuration parameters correspond to the bearer capability 2 information element of a mobile 
originating SETUP message, as defined in TS 24.008 [9]. If no capability configuration parameters are present, 
this shall indicate a speech call. 

Subaddress: Only used for a call set-up, this contains the called party subaddress that the ME is proposing to 
send to the network. If one is not present, this shall indicate that the ME is proposing not to send this information 
element to the network. 

Location information: This data object contains the identification (MCC, MNC, LAC/TAC, Cell Identity) of the 
current serving cell of the UE. The comprehension required flag of this data object in this command shall be set 
to '0'. 

Response parameters/data. 

It is permissible for the UICC to provide no response data, by responding with SW1/SW2 = '90 00'. If the UICC does 
not provide any response data, then this shall have the same meaning as "allowed, no modification". 



Description 


Clause 


M/O/C 


Min 


Length 


Call control result 


- 


M 


Y 


1 


Length (A+B+C+D+E+F) 


- 


M 


Y 


1 or 2 


Address or SS string or USSD string or PDP 
context activation parameters or EPS PDN 
connection activation parameters or IMS 
Request-URl 


8.1,8.14or 

8.1 7 or 8.72 

or 8.98 or 

8.108 





N 


A 


Capability configuration parameters 1 


8.4 





N 


B 


Subaddress 


8.3 





N 


C 


Alpha identifier 


8.2 





N 


D 


BC repeat indicator 


8.42 


C 


N 


E 


Capability configuration parameters 2 


8.4 





N 


F 



Call control result: 



Contents: 



The command that the UICC gives to the ME concerning whether to allow, bar or modify the proposed call 
(or supplementary service operation); 



Coding: 

'00' = Allowed, no modification; 
- 'Or = Not allowed; 

'02' = Allowed with modifications. 

Address or SS string or USSD string or PDP context/EPS PDN connection activation parameters or IMS 
Request-URl: Only one data object may be included if the UICC requests the call (or supplementary service or 
USSD operation or PDP context/EPS PDN connection activation or IMS communication establishment) details 
to be modified: 

for a call set-up, if the address data object is not present, then the ME shall assume the Dialling number is not to 
be modified; 

if the SS string data object or address data object is present and the ME receives wild values according to 
TS 31.102 [14], then the ME shall not process the command. 
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For a supplementary service, if the SS string data object is not present, then the ME shall assume that SS is not to 
be modified; 

for a USSD operation, if the USSD string data object is not present, then the ME shall assume that the USSD 
operation is not to be modified; 

for a PDP context activation, if the PDP context activation parameters object is not present, then the ME shall 
assume that the PDP context activation is not to be modified; 

for an EPS PDN connection activation, if the EPS PDN connection activation parameters object is not present, 
then the ME shall assume that the EPS PDN connection activation is not to be modified; 

for an IMS communication establishment, if the IMS Request-URI data object is not present, then the ME shall 
assume that neither the SIP URI nor the tel URI are to be modified. 

Capability configuration parameters: Only used for a call set-up, this data object is only required if the USIM 
application requests the call details to be modified. The first capability configuration parameters corresponds to 
the bearer capability 1 information element of a mobile originating SETUP message, as defined in 
TS 24.008 [9]. The second capability configuration parameters corresponds to the bearer capability 2 
information element of a mobile originating SETUP message, as defined in TS 24.008 [9]. If the capability 
configuration parameters are not present, then the ME shall assume the parameters are not to be modified. 

Subaddress: Only used for a call set-up, this data object is only required if the USIM application requests the call 
details to be modified. If the subaddress is not present, then the ME shall assume the called party subaddress is 
not to be modified. If the subaddress supplied by the USIM application is a null data object, then the ME shall 
not provide a called party subaddress to the network. A null data object shall have length = '00' and no value 
part. 

Alpha identifier: this data object is only required if the UICC requests a particular indication to be given to the 
user. The handling of this data object by the ME is described in clause 7.3.1.3. The comprehension required flag 
of this data object shall be set to '0'. 

BC repeat indicator: indicates how the associated bearers shall be interpreted. The change of bearer occurs on a 
network event. This BC repeat indicator is conditioned to the presence of the second capability configuration 
parameters and is coded as defined in TS 24.008 [9]. 

It is mandatory for the UICC to provide at least one of the optional data objects if it has set the Call control result to 
"allowed with modifications". 

7.3.1 .7 Procedure for PDP Context Activation 

If the service "call control on GPRS by USIM" is available in the USIM Service Table (see TS 31.102 [14]), then for all 
PDP Context activation (including those resulting from a OPEN CHANNEL proactive UICC command where GPRS is 
selected), the ME shall first pass the corresponding Activate PDP Context message (see TS 24.008 [9]) to the UICC, 
using the ENVELOPE (CALL CONTROL) command defined below. The ME shall also pass to the UICC in the 
ENVELOPE (CALL CONTROL) command the current serving cell. 

The UICC shall respond in the same way as for mobile originated calls. The ME shall interpret the response as follows: 

if the UICC responds with '90 00', the ME shall send the Activate PDP Context message with the information as 
sent to the UICC; 

if the UICC responds with '93 00', the ME shall not the Activate PDP Context message and may retry the 
command; 

if the UICC provides response data, then the response data from the UICC shall indicate to the ME whether to 
send the Activate PDP Context message as proposed, not send the Activate PDP Context message or send the 
Activate PDP Context message using the data supplied by the UICC. It is mandatory for the ME to perform the 
PDP Context Activation in accordance with the data from the UICC, if it is within the ME's capabilities to do so. 
If the UICC requires PDP Context Activation that is beyond the ME's capabilities, then the ME shall not perform 
PDP Context Activation at all. 

In the case where the initial PDP Context Activation request results from a proactive command OPEN CHANNEL 
where GPRS is selected: 
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- if the call control result is "not allowed", the ME shall inform the UICC using TERMINAL RESPONSE 
("interaction with call control by UICC or MO short message control by UICC, action not allowed"); 

if the PDP Context Activation data is changed by call control, then the ME shall activate the PDP context using 
the data given by the UICC, if it is within the ME's capabilities to do so. If the UICC requires a PDP Context 
Activation that is beyond the ME's capabilities (e.g. the UICC requests a QoS that the ME cannot handle ), then 
the ME shall not activate the PDP context at all. 

7.3.1 .8 Procedure for EPS PDN connection Activation 

If the service "call control on EPS PDN connection by USIM" is available in the USIM Service Table (see 
TS 31.102 [14]), then for all EPS PDN connection activation (including those resulting from a OPEN CHANNEL 
proactive UICC command where E-UTRAN is selected), the ME shall first pass the corresponding PDN Connectivity 
Request message (see TS 24.301 [XX]) to the UICC, using the ENVELOPE (CALL CONTROL) command defined 
above. The ME shall also pass to the UICC in the ENVELOPE (CALL CONTROL) command the current serving cell. 

The UICC shall respond in the same way as for mobile originated calls. The ME shall interpret the response as follows: 

if the UICC responds with '90 00', the ME shall send the PDN Connectivity Request message with the 
information as sent to the UICC; 

if the UICC responds with '93 00', the ME shall not send the PDN Connectivity Request message and may retry 
the command; 

if the UICC provides response data, then the response data from the UICC shall indicate to the ME whether to 
send the PDN Connectivity Request message as proposed, not send the PDN Connectivity Request message or 
send the PDN Connectivity Request message using the data supplied by the UICC. It is mandatory for the ME to 
perform the EPS PDN Connection Activation in accordance with the data from the UICC, if it is within the ME's 
capabilities to do so. If the UICC requires EPS PDN Connection Activation that is beyond the ME's capabilities, 
then the ME shall not perform EPS PDN Connection Activation at all. 

In the case where the initial PDN Connectivity Request results from a proactive command OPEN CHANNEL where E- 
UTRAN is selected: 

- if the call control result is "not allowed", the ME shall inform the UICC using TERMINAL RESPONSE 
("interaction with call control by UICC or MO short message control by UICC, action not allowed"); 

if the EPS PDN Connection Activation data is changed by call control, then the ME shall activate the EPS PDN 
Connection using the data given by the UICC, if it is within the ME's capabilities to do so. If the UICC requires a 
EPS PDN Connection Activation that is beyond the ME's capabilities (e.g. the UICC requests a QoS that the ME 
cannot handle), then the ME shall not activate the EPS PDN Connection at all. 

7.3.1 .9 Procedure for IMS communications establishment 

If the service "communication control for IMS by USIM" is available in the USIM Service Table (see TS 31.102 [14]), 
then for all IMS communication establishment, the ME shall first pass the corresponding IMS Request-URI contained 
in SIP INVITE message (see TS24.229 [52]) to the UICC, using the ENVELOPE (CALL CONTROL) command 
defined above. The ME shall also pass to the UICC in the ENVELOPE (CALL CONTROL) command the current 
serving cell. 

When the ME detects that an IMS emergency call is being initiated, the ME shall set up an emergency call without 
sending the ENVELOPE (CALL CONTROL) command to the UICC. 

The UICC shall respond in the same way as for mobile originated communications. The ME shall interpret the response 
as follows: 

if the UICC responds with '90 00', the ME shall send the SIP INVITE message with the information as sent to the 
UICC; 

if the UICC responds with '93 00', the ME shall not send SIP INVITE message and may retry the command; 

if the UICC provides response data, then the response data from the UICC shall indicate to the ME whether to 
send the SIP INVITE message as proposed, not send the SIP INVITE message or send the SIP INVITE message 
using the data supplied by the UICC. It is mandatory for the ME to perform the SIP INVITE request in 
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accordance with the data from the UICC, if it is within the ME's capabilities to do so. If the UICC requires SIP 
INVITE request that is beyond the ME's capabilities, then the ME shall not send SIP INVITE request at all. 



7.3.2 MO Short Message Control by USIM 



7.3.2.1 



Description 



If the service "MO Short Message Control" is available in the USIM Service Table (see TS 31.102 [14]), then the ME 
shall follow the procedure below: 

for all MO short message attempts (even those resulting from a SEND SM proactive UICC command), the ME 
shall first pass the RP_destination_address of the service centre and the TP_Destination_Address to the UICC, 
using the ENVELOPE (MO SHORT MESSAGE CONTROL) command defined below. The ME shall also pass 
to the UICC in the ENVELOPE (MO SHORT MESSAGE CONTROL) command the current serving cell; 

if the UICC responds with '90 00', the ME shall send the short message with the addresses unchanged; 

if the UICC responds with any other status code indicating an error, the ME shall not send the short message; 

if the UICC responds with '93 00', the ME shall not send the short message and may retry the command; 

if the UICC provides response data, then the response data from the UICC shall indicate to the ME whether to 
send the short message as proposed, not send the short message or send a short message using the data supplied 
by the UICC. It is mandatory for the ME to perform the MO short message request in accordance with the data 
from the UICC. 

The ME shall then follow the MO Short Message procedure defined in TS 24.01 1 [10]. 

In the case where the initial MO short message request results from a proactive command SEND SHORT MESSAGE, 
if the MO short message control result is "not allowed", the ME shall inform the UICC using TERMINAL RESPONSE, 
"interaction with call control by UICC or MO short message control by UICC, action not allowed". 

7.3.2.2 Structure of ENVELOPE (MO SHORT MESSAGE CONTROL) 

Direction: ME to UICC. 

The command header is specified in TS 31.101 [13]. 

Command parameters/data. 



Description 


Clause 


IVI/O/C 


Min 


Length 


MO Short Message control tag 


9.1 


M 


Y 


1 


Length (A+B+C+D) 


- 


M 


Y 


1 or 2 


Device identities 


8.7 


M 


Y 


A 


Address data object 1 


8.1 


M 


Y 


B 


Address data object 2 


8.1 


M 


Y 


C 


Location information 


8.19 


M 


Y 


D 



Device identities: the ME shall set the device identities to: 

source: ME; 

destination: UICC. 

Address data object 1: this address data object 1 contains the RP_Destination_Address of the Service Centre to 
which the ME is proposing to send the short message. 

Address data object 2: this address data object 2 contains the TP_Destination_Address to which the ME is 
proposing to send the short message. 
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Location information: this data object contains the identification (MCC, MNC, LAC, Cell Identity) of the current 
serving cell of the UE. 

Response parameters/data. 

It is permissible for the UICC to provide no response data, by responding with SW1/SW2 = '90 00'. If the UICC does 
not provide any response data, then this shall have the same meaning as "allowed, no modification". 



Description 


Clause 


M/O/C 


Min 


Length 


MO short message control result 


- 


M 


Y 


1 


Length (A+B+C) 


- 


M 


Y 


1 or 2 


Address data object 1 


8.1 





N 


A 


Address data object 2 


8.1 





N 


B 


Alpha identifier 


8.2 





N 


C 



MO Short Message control result: 
Contents: 

The command that the UICC gives to the ME concerning whether to allow, bar or modify the proposed short 

message; 

Coding: 

'00' = Allowed, no modification; 
- 'Or = Not allowed; 

'02' = Allowed with modifications. 

Address data object 1: if the address data object 1 is not present, then the ME shall assume the 
RP_Destination_Address of the Service Centre is not to be modified. 

if the address data object 1 or address data object 2 is present and the ME receives wild values according to 
TS 31.102 [14], then the ME shall not process the command. 

Address data object 2: if the address data object 2 is not present, then the ME shall assume the 
TP_Destination_Address is not to be modified. 

Alpha identifier: this data object is only required if the UICC requests a particular indication to be given to the 
user. The handling of this data object by the ME is described in clause 7.3.2.3. 

The UICC shall provide the two optional address data objects if it has set the MO Short Message control result to 
"allowed with modifications". 



7.3.2.3 



Indication to be given to the user 



The UICC may optionally include an alpha-identifier in the response data to the ENVELOPE (MO SHORT MESSAGE 
CONTROL) message, in order to inform the user at the time the response is received by the ME. The use of this alpha 
identifier by the ME is identical to the one described in clause 7.3.1.3 relative to call control by UICC. 



7.3.2.4 



Interaction with Fixed Dialling Number 



It is permissible for the Fixed Dialling Number service to be enabled (see TS 31.102 [14]) at the same time as MO Short 
Message Control is available (in the USIM Service Table). If FDN is enabled, the ME shall follow the procedure for 
Call Control (see clause 7.3.1.4), where the number in the procedure refers to both the SMS destination address and the 
SMSC address. 



7.4 Timer Expiration 

See ETSI TS 102 223 [32] clause 7.4. 
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7.5 



Event download 



See ETSI TS 102 223 [32] clause 7.5. 

Regarding all the call events, the following equivalences shall apply : 

the "call setup message" is the SETUP message as defined in TS 24.008 [09]; 

- the "call connect message" is the CONNECT message as defined in TS 24.008 [09]; 

- the "disconnect messages" are the DISCONNECT, RELEASE, RELEASE COMPLETE messages as defined in 
TS 24.008 [09]; 

- the "NULL state" is the CC-UO state as defined in TS 24.008 [09]. 
Regarding the location status event, the following equivalence shall apply: 

- the "idle" state is the MM-IDLE state as defined in TS 24.008 [09] for GERAN/UTRAN and the EMM-IDLE 
state as defined in TS 24.301 [46] for E-UTRAN. 

Where events occur and the UICC responds with '93 00', the ME shall retry to deliver the event download messages to 
the UICC. 



7.5.1 



l-WLAN Access status event 



7.5.1.1 



Procedure 



If the I-WLAN Access Status event is part of the current event list (as set up by the last SET UP EVENT LIST 
command, see clause 6.4.16), then, when the terminal detects a change in its current I-WLAN access the terminal shall 
inform the UICC that this has occurred, by using the ENVELOPE (EVENT DOWNLOAD - I-WLAN Access Status) 
command as defined in clause 7.5.1.2. 

7.5.1 .2 Structure of ENVELOPE (EVENT DOWNLOAD - I-WLAN Access Status) 

Direction: terminal to UICC. 

The command header is specified in TS 31.101 [13]. 

Command parameters/data. 



Description 


Clause 


M/0 


Min 


Length 


Event download tag 


9.1 


M 


Y 


1 


Length (A+B+C) 


- 


M 


Y 


1 or 2 


Event list 


8.25 


M 


Y 


A 


Device identities 


8.7 


M 


Y 


B 


I-WLAN Access Status 


8.84 


M 


Y 


C 



Event list: the Event list data object shall contain only one event (value part of length 1 byte), and terminal shall set the 
event to: 

I-WLAN Access Status. 
Device identities: the terminal shall set the device identities to: 

source: terminal; 

destination: UICC. 

I-WLAN Access Status: this data object shall contain the I-WLAN Access status of the terminal. 
Response parameters/data: None for this type of ENVELOPE command. 
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7.5.1 A MT Call event 

See ETSI TS 102 223 [32] clause 7.5.1. 

7.5.2 Network Rejection event 



7.5.2.1 



Procedure 



If the Network Rejection event is part of the current event list (as set up by the last SET UP EVENT LIST command, 
see ETSI TS 102 223 [32] clause 6.4.16), then, in the case of GERAN/UTRAN if the terminal receives a LOCATION 
UPDATING REJECT message or a GPRS ATTACH REJECT message or a ROUTING AREA UPDATE REJECT 
message (as defined in TS 24.008 [9]) or in the case of E-UTRAN if the terminal receives an ATTACH REJECT 
message or TRACKING AREA UPDATE REJECT message, the terminal shall inform the UICC that this has occurred, 
by using the ENVELOPE (EVENT DOWNLOAD - Network Rejection Event) command as defined below. 

7.5.2.2 Structure of ENVELOPE (EVENT DOWNLOAD - Network Rejection) 

Direction: ME to UICC. 

The command header is specified in TS 31.101 [13]. 

Command parameters/data. 



Description 


Clause 


M/0 


Min 


Length 


Event download tag 


9.1 


M 


Y 


1 


Length (A+B+(C or D or l)+E+F+G+H) 


- 


M 


Y 


1 


Event list 


8.25 


M 


Y 


A 


Device identities 


8.7 


M 


Y 


B 


Location Information 


8.19 


C 


N 


C 


Routing Area Identification 


8.91 


C 


N 


D 


Tracking Area Identification 


8.99 


c 


N 


1 


Access Technology 


8.62 


M 


Y 


E 


Update/Attach Type 


8.92 


M 


Y 


G 


Rejection Cause Code 


8.93 


M 


Y 


H 



Event list: the Event list data object shall contain only one event (value part of length 1 byte), and terminal shall set the 
event to: 

• Network Rejection Event. 

Device identities: the terminal shall set the device identities to: 

• source: Network; 

• destination: UICC. 

Location information: This data object shall only be present when the ME receives a LOCATION UPDATING 
REJECT message, and shall contain the identification (MCC, MNC, and LAC) of the rejecting network. 

Routing Area Identification: This data object shall only be present when the ME receives a GPRS ATTACH 
REJECT message or a ROUTING AREAD UPDATE REJECT message and shall contain the identification (MCC, 
MNC, LAC and RAC) of the rejecting network. 

Tracking Area Identification: This data object shall only be present when the ME receives an EMM ATTACH 
REJECT or a TRACKING AREA UPDATE REJECT message and shall contain the identification (MCC, MNC and 
TAC) of the rejecting network. 

Access Technology: This data object shall contain the access technology of the rejecting network. 

Update/Attach Type: This data object contains the update or attach type that was used in the registration request 

message. 
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Rejection Cause Code: This data object contains the cause code value that was received in the registration reject 

message. 

Response parameters/data: None for this type of ENVELOPE command. 

7.5.2A Call connected event 

See ETSI TS 102 223 [32] clause 7.5.2. 

7.5.3 CSG Cell Selection event 

The following clause applies if class "q" is supported 



7.5.3.1 



Procedure 



If the CSG Cell Selection event is part of the current event list (as set up by the last SET UP EVENT LIST command, 
see ETSI TS 102.223 [32]), then, when the ME detects a change in its current CSG or Hybrid cell selection status, the 
ME shall inform the UICC that it has occurred, using ENVELOPE (EVENT DOWNLOAD - CSG Cell Selection) as 
defined below. 

7.5.3.2 Structure of ENVELOPE (EVENT DOWNLOAD - CSG Cell Selection) 

Direction : ME to UICC 

The command header is specified in TS 31.101 [13] 

Command parameters/data 



Description 


Clause 


M/0 


Min 


Length 


Event download tag 


9.1 


M 


Y 


1 


Length (A+B+C+D+E+F) 


- 


M 


Y 


1 


Event list 


8.25 


M 


Y 


A 


Device identities 


8.7 


M 


Y 


B 


Access Technology 


8.62 


C 


Y 


C 


CSG cell selection status 


8.101 


M 


Y 


D 


CSG id 


8.102 


C 


N 


E 


HNB name 


8.103 


C 


N 


F 



Event list: the Event list data object shall contain only one event (value part of length 1 byte), and terminal shall set 
the event to: 

• CSG Cell Selection. 

Device identities: the terminal shall set the device identities to: 

• source: Network; 

• destination: UICC. 

Access Technology: This data object shall contain the access technology of the current serving cell. If the device is 
not camping on any cell, this data object shall not be present. 

CSG cell selection status: this data object shall contain CSG or Hybrid cell selection status. The ME should send the 
event indicating that it is not camped on a CSG or Hybrid cell only after a previous event that indicated that UE was 
camped on a CSG or Hybrid cell. 

- CSG id: If the UE is camping on a CSG or Hybrid cell in the Allowed CSG list or the Operator CSG Ust, this data 
object shall be present, and shall contain CSG id of the current serving CSG or Hybrid cell. In all other cases this 
data object shall not be present. 

HNB name: If the UE is camping on a CSG or Hybrid cell in the Allowed CSG list or the Operator CSG list and the 
HNB name of the cell is available in the broadcasted information to the ME, this data object shall be present, and 



£75/ 



3GPP TS 31 .1 1 1 version 1 1 .3.0 Release 1 1 65 ETSI TS 1 31 1 1 1 V1 1 .3.0 (201 2-1 0) 

shall contain the broadcasted HNB name of the current serving CSG or Hybrid cell. In all other cases this data 
object shall not be present. 

Response parameters/data: None for this type of ENVELOPE command. 

7.5.3A Call disconnected event 

See ETSI TS 102 223 [32] clause 7.5.3. 

7.5.4 Location status event 

See ETSI TS 102 223 [32] clause 7.5.4. 

7.5.5 User activity event 

See ETSI TS 102 223 [32] clause 7.5.5. 

7.5.6 Idle screen available event 

See ETSI TS 102 223 [32] clause 7.5.6. 

7.5.7 Card reader status event 

See ETSI TS 102 223 [32] clause 7.5.7. 

7.5.8 Language selection event 

See ETSI TS 102 223 [32] clause 7.5.8. 

7.5.9 Browser termination event 

See ETSI TS 102 223 [32] clause 7.5.9. 

7.5.1 Data available event 

See ETSI TS 102 223 [32] clause 7.5.10. 

7.5.1 1 Channel status event 

See ETSI TS 102 223 [32] clause 7.5.11. 

7.5.12 Access Technology Change Event 

See ETSI TS 102 223 [32] clause 7.5.12. 

7.5.1 3 Display parameters changed event 

See ETSI TS 102 223 [32] clause 7.5.13. 

7.5.14 Local Connection event 

See ETSI TS 102 223 [32] clause 7.5.14. 

7.5.15 Network Search Mode Change Event 

See ETSI TS 102 223 [32] clause 7.5.15. 
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7.5.16 Browsing Status event 

See ETSI TS 102 223 [32] clause 7.5.16. 

7.5.17 Frames Information clianged event 

See ETSI TS 102 223 [32] clause 7.5.17. 

7.5.18 HC I connectivity event 

Not required by 3GPP. 

7.5.19 Contactless state request 

Not required by 3GPP. 

7.5.20 Incoming IMS Data event 

The following clauses apply if classes "e" and "t" are supported. 
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7.5.20.1 



Procedure 



If the Incoming IMS data event is part of the current event list (as set up by the last SET UP EVENT LIST command, 
see ETSI TS 102 223 [32]), then, in the case of an incoming IMS message to an lARI (see TS 24.229 [52]) associated to 
an application installed on the UICC and no open channel is available for IMS communication, see 3GPP TS 31.102 
[14], the terminal shall inform the UICC that this has occurred, by using the ENVELOPE (EVENT DOWNLOAD - 
Incoming IMS data) command as defined below. 

7.5.20.2 Structure of ENVELOPE (EVENT DOWNLOAD - Incoming IMS Data) 

Direction : ME to UICC 

The command header is specified in TS 31.101 [13] 

Command parameters/data 



Description 


Clause 


M/0 


Min 


Length 


Event download tag 


9.1 


M 


Y 


1 


Length A+B+G 


- 


M 


Y 


1 or 2 


Event list 


8.25 


M 


Y 


A 


Device identities 


8.7 


M 


Y 


B 


lARI 


8.110 


M 


Y 


G 



Event list: the Event list data object shall contain only one event (value part of length 1 byte), and terminal shall set 
the event to: 

• Incoming IMS Data event. 

Device identities: the terminal shall set the device identities to: 

• source: Network; 

• destination: UICC. 

lARI: This data object contains the lARI included in the Accept-Contact (see TS 24.229 [52]) header field of the 
incoming SIP INVITE IMS message destined for the UICC. 

Response parameters/data: None for this type of ENVELOPE command. 
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7.5.21 IMS Registration Event 

The following clauses apply if classes "e" and "t" are supported. 



7.5.21.1 



Procedure 



If the IMS Registration event is part of the current event list (as set up by the last SET UP EVENT LIST command, see 
ETSI TS 102 223 [32]), then, upon receiving the 200 OK (see 3GPP TS 24.229 [52]) message in response to the SIP 
REGISTER message (see 3GPP TS 24.229 [52]) or upon receiving any status code (see 3GPP TS 24.229 [52]) 
indicating a failure in response to the SIP REGISTER message, the terminal shall inform the UICC that this event has 
occurred, by using the ENVELOPE (EVENT DOWNLOAD - IMS Registration) command as defined below. 

7.5.21 .2 Structure of ENVELOPE (EVENT DOWNLOAD - IMS Registration) 

Direction : ME to UICC 

The command header is specified in TS 31.101 [13] 

Command parameters/data 



Description 


Clause 


M/O/C 


Min 


Length 


Event download tag 


9.1 


M 


Y 


1 


Length (A+B+C) or (A+B+D) 


- 


M 


Y 


1 or 2 


Event list 


8.25 


M 


Y 


A 


Device identities 


8.7 


M 


Y 


B 


IMPU list 


8.111 


C 


Y 


C 


IIVIS status code 


8.112 


C 


Y 


D 



Event list: the Event list data object shall contain only one event (value part of length 1 byte), and terminal shall set 
the event to: 

• IMS Registration Event. 

Device identities: the terminal shall set the device identities to: 

• source: Network; 

• destination: UICC. 

IMPU list: This data object shall contain the list of IMPUs built from the URIs from the aor (address of record) 
attributes for which within the same registration element at least one of the ME"s contact URIs has the status "active" 
(see RFC 3680 [55]) received in the registration event package (see 3GPP TS 24.229 [52]) of the SIP NOTIFY request. 
This data object shall only be present in the case of a successful registration. If the network indicates, using the SIP 
NOTIFY request containing the registration event package, that there are no aor attributes that for which within the 
same registration element at least one of the ME"s contact URIs has the status "active" then the ME shall send an 
empty list of IMPUs to the UICC. 

- Status Code: This data object shall contain the Status-code (see 3GPP TS 24.229 [52]) received from the IMS 
network in response to a SIP REGISTER message. This data object shall only be present to indicate that a failure 
occurred during an IMS registration. 

Response parameters/data: None for this type of ENVELOPE command. 

7.5.22 Profile Container 

Not required by 3GPP. 

7.5.23 Envelope Container 

Not required by 3GPP. 
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7.6 



USSD Data Download 



This clause applies if class "p" is supported. 

7.6.1 Procedure 

If the service "data download via USSD and USSD application mode" is allocated and activated in the USIM Service 
Table (see TS 31.102 [14]), then the ME shall follow the procedure below: 

When the ME receives a USSD packet it shall pass the message transparently to the USIM using the 
ENVELOPE (USSD DOWNLOAD) if the Data Coding Scheme of the USSD message (as defined for the CBS 
Data Coding Scheme in TS 23.038 [4]) indicate the USIM as the target (Bit set to and Bit 1 set to 1): 

The ME shall wait for an acknowledgement from the USIM: 

if the UICC responds with '90 00', the ME shall acknowledge the receipt of USSD message to the 
network using a FACILITY message. The ME will supply the response data from the UICC in the USSD 
String of the return result component of the FACILITY message it will send back to the network (see 
TS 24.090 [37]). The alphabet and language indicators shall be those used in the original message. 

if the USIM responds with '93 00', the ME shall either retry the command or send back a FACILITY 
message to the network. The ME will supply the status word followed by the response data from the 
UICC in the USSD String of the return result component of the FACILITY message it will send back to 
the network (see TS 24.090 [37]). The alphabet and language indicators shall be those used in the original 

message. 

- if the UICC responds with '62 XX' or '63 XX', the ME shall acknowledge the receipt of the USSD 

message to the network using a FACILITY message. The ME will supply the status word followed by the 
response data from the UICC in the USSD String of the return result component of the FACILITY 
message it will send back to the network (see TS 24.090 [37]). The alphabet and language indicators shall 
be those used in the original message. 

If the service "data download via USSD and USSD application mode " is not allocated and activated in the USIM 
Service Table, and the ME receives a USSD message with a Data Coding Scheme indicating that the destination is the 
card (as defined above), the ME shall return a FACILITY message to the network. The ME will supply the status word 
'6D 00' (i.e. Instruction code not supported or invalid) in the USSD String of the return result component of the 
FACILITY message it will send back to the network (see TS 24.090 [37]). The alphabet and language indicators shall 
be those used in the original message. 



7.6.2 Structure of ENVELOPE (USSD Data Download) 

Direction: ME to UICC 

The command header is specified in TS 31.101 [13]. 

Command parameters/data: 



Description 


Section 


IVI/0 


Min 


Length 


USSD Download tag 


9.1 


M 


Y 


1 


Length (A+B) 


- 


M 


Y 


1 or 2 


Device identities 


8.7 


M 


Y 


A 


USSD string 


8.17 


M 


Y 


B 



Device identities: the ME shall set the device identities to: 
Source: Network 

Destination: UICC 

Response parameters/data: 
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It is permissible for the UICC not to provide response data. If the UICC provides response data, the following data is 
returned. 



Byte(s) 


Description 


Length 


1-X(X<182) 


UICC response 


X 



7.7 MMS Transfer Status 

See ETSI TS 102 223 [32] clause 7.6. 

7.8 MMS notification download 

See ETSI TS 102 223 [32]. 

Considering the addressing mechanism to the UICC indicated in ETSI TS 102 223 [32] clause 7.7, the UICC shall be 
targeted using the following application identifier: "uicc.3gpp.org". 

7.9 Terminal Applications 

See ETSI TS 102 223 [32] clause 7.8. 

7.10 Geographical Location Reporting 

7.10.1 Procedure 

This clause applies if class "n" is supported. 

If the ME has processed the proactive command "Geographical Location Request" successfully, then the ME shall send 
the ENVELOPE (Geographical Location Reporting). 

It is acceptable for the ME to send the envelope even if the requested accuracy has not been achieved. 

Note: some GAD Shapes contain the actual accuracy. 

If positioning data cannot be provided, the envelope command shall neither include the GAD shape TLV nor the 
NMEA-sentence TLV. 

If positioning data can be provided, the envelope command shall include either a GAD shape TLV or a NMEA-sentence 
TLV. The information sent by the ME is deemed fresh. 

7.10.2 Structure of ENVELOPE (Geographical Location Reporting) 

Direction: ME to UICC. 

The command header is specified in TS 31.101 [13]. 

Command parameters/data. 



Description 


Clause 


IVI/O/C 


Min 


Length 


Geographical Location Reporting tag 


9.1 


M 


Y 


1 


Length (A or A+B or A+C) 


- 


M 


Y 


1 or 2 


Device identities 


8.7 


M 


Y 


A 


GAD shape 


8.95 


C 


N 


B 


NIVIEA sentence 


8.96 


C 


N 


C 



Device identities: the ME shall set the device identities to: 
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source: ME; 

destination: UICC. 
GAD shape: This data object contains the location information. 
NMEA sentence: This data object contains the location information. 
Response parameters/data: None for this type of ENVELOPE command. 



8 COMPREHENSION-TLV data objects 

The coding of the TLV objects is as described in ETSI TS 102 223 [32] clause 8, except when stated otherwise in the 
present document. 

8.1 Address 

See ETSI TS 102 223 [32] clause 8.1. 

8.2 Alpha identifier 

See ETSI TS 102 223 [32] clause 8.2. 

8.3 Subaddress 

See ETSI TS 102 223 [32] clause 8.3. 

8.4 Capability configuration parameters 



Byte(s) 


Description 


Length 


1 


Capability configuration parameters tag 


1 


2to(Y-1)+2 


Length (X) 


Y 


(Y-1)+3to 
(Y-1)+X+2 


Capability configuration parameters 


X 



Capability configuration parameters are coded as for EFccp- If it is being provided by the UICC, the UICC shall supply 
all information required to complete the Bearer Capability Information Element in the Call Set-up message (see 
TS 24.008 [9]). Any unused bytes at the end of the value part shall be coded 'FF'. 

See TS 31.102 [14] for the coding of all Efs. 

NOTE: The second byte of this TLV contains the Length of the TLV and the third byte contains the Length of the 
bearer capability contents, followed by the actual contents. 



8.5 Cell Broadcast Page 



Byte(s) 


Description 


Length 


1 


Cell Broadcast page tag 


1 


2 


Length = '58' (88 decimal) 


1 


3-90 


Cell Broadcast page 


88 
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The Cell Broadcast page is formatted in the same way as the GSM Cell Broadcast Message Parameter, as described in 
TS 23.041 [6]. 

8.6 Command details 

The content and the coding of the Command Details TLV object is defined in ETSI TS 102 223 [32] clause 8.6, except 
for the following. 

The coding of the Command Qualifier is defined for the following commands: 

- SEND SS: 

this byte is RFU. 

- SEND USSD: 
this byte is RFU. 

- PROVIDE LOCAL INFORMATION. The following additional values are defined: 

'00' = Location Information (MCC, MNC, LAC/TAC, Cell Identity and Extended Cell Identity) 

'02' = Network Measurement results. 

'05' = Timing Advance. 

'OC = current WSID. 

'11' = CSG ID list and corresponding HNB name. 

'12' = H(e)NB IP address. 

'13' = H(e)NB surrounding macrocells. 
The following values do not apply 

'07' = Reserved by ETSI (ESN) 

'OB' = Reserved by ETSI (MEID) 
REFRESH. The following additional values are defined: 
'07' = Steering of Roaming as defined in TS 23.122 [7]. 
'08' = Steering of Roaming for I-WLAN as defined in TS 24.234 [42]. 
Geographical Location Request: 
this byte is RFU. 

- OPEN CHANNEL related to CS bearer, GPRS/UTRAN packet service/E-UTRAN, local bearer. Default 
(network) bearer, I-WLAN bearer. Terminal Server Mode, UICC Server Mode: 

- As defined in ETSI TS 102 223 [32] 

- OPEN CHANNEL for IMS : 

- This byte is RFU 



8.7 Device identities 

See ETSI TS 102 223 [32] clause 8.7. 
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8.8 Duration 

See ETSI TS 102 223 [32] clause 8.8. 

8.9 Item 

See ETSI TS 102 223 [32] clause 8.9. 

8.10 Item identifier 

See ETSI TS 102 223 [32] clause 8.10. 

8.11 Response length 

See ETSI TS 1 02 223 [32] clause 8.11. 

8.12 Result 

For the general result byte coding the following values are defined in addition to or replacement of those in 
ETSI TS 102 223 [32] clause 8.12: 

'14' = USSD or SS transaction terminated by the user 

- '34' = SS Return Error; 

- '35' = SMS RP-ERROR; 

- '37' = USSD Return Error; 

'39' = Interaction with call control by USIM or MO short message control by USIM, permanent problem; 

Additional information: 

Contents: 

For the general result "Command performed successfully", some proactive commands require additional 
information in the command result. This is defined in the clauses below. For the general result values '20', 
'21', '34', '35', '37', and '39', it is mandatory for the ME to provide a specific cause value as additional 
information, as defined in the clauses below. For other values, see ETSI TS 102 223 [32] clause 8.12. 

8.1 2.1 Additional information for SEND SS 

When the ME issues a successful general result for a SEND SS proactive command, it shall also include the Operation 
Code and Parameters included in the Return Result component from the network, as additional information. 

The first byte of the additional information shall be the SS Return Result Operation code, as defined in TS 24.080 [11]. 

The rest of the additional information shall be the SS Return Result Parameters, as defined in TS 24.080 [11]. 

8.12.2 Additional information for ME problem 

For the general result "ME currently unable to process command", it is mandatory for the ME to provide additional 
information, the first byte of which to be as defined in ETSI TS 102 223 [32] clause 8.12.2, with the addition of the 
following value: 

'03' = ME currently busy on SS transaction; 

'08' = ME currently busy on USSD transaction. 
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8.1 2.3 Additional information for networl< problem 

For the general result "network currently unable to process command", it is mandatory for the ME to provide additional 
information. The first byte shall be the cause value of the Cause information element returned by the network (as 
defined in TS 24.008 [9]). Bit 8 shall be set to '1'. One further value is defined: 

'00' = No specific cause can be given. 

All other values shall be interpreted by the UICC as '00'. The coding '00' shall only be used by the ME if no others 
apply. 

8.1 2.4 Additional information for SS problem 

For the general result "SS Return Error", it is mandatory for the ME to provide additional information. The first byte 
shall be the error value given in the Facility (Return Error) information element returned by the network (as defined in 
TS 24.080 [11]). One further value is defined: 

'00' = No specific cause can be given. 

All other values shall be interpreted by the UICC as '00'. The coding '00' shall only be used by the ME if no others 
apply. 

8.1 2.5 Additional information for SMS problem 

For the general result "SMS RP-ERROR", it is mandatory for the ME to provide additional information. The first byte 
shall be the cause value given in the RP-Cause element of the RP-ERROR message returned by the network (as defined 
in TS 24.01 1 [10]), with bit 8 = 0. One further value is defined: 

'00' = No specific cause can be given. 

All other values shall be interpreted by the UICC as '00'. Specific cause '00' shall only be used by the ME if no others 
apply. 

8.12.6 Not used 



8.12.7 Additional information for USSD problem 

For the general result "USSD Return Error", the ME shall provide additional information. The first byte shall be the 
error value given in the Facility (Return Error) information element returned by the network (as defined in 
TS 24.080 [11]). One further value is defined: 

'00' = No specific cause can be given. 

All other values shall be interpreted by the UICC as '00'. 

The coding '00' shall only be used by the ME if no others apply. 

8.12.8 Additional information for interaction with call control or MO SM 
control 

For the general result "interaction with call control by USIM or MO short message control by USIM, permanent 
problem", it is mandatory for the ME to provide additional information, the first byte of which to be as defined below: 

'00' = No specific cause can be given; 

'01 ' = Action not allowed; 

'02' = The type of request has changed. 
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All other values shall be interpreted by the UICC as '00'. The coding '00' shall only be used by the ME if no others 
apply. 

8.1 2.9 Additional information for MultipleCard commands 

See ETSI TS 102 223 [32] clause 8.12.9. 

8.1 2.1 Additional information for launch browser problem 

See ETSI TS 102 223 [32] clause 8.12.10. 

8.1 2.1 1 Additional information for Bearer Independent Protocol 

See ETSI TS 1 02 223 [32] clause 8.12.11. 

8.12.12 Additional information for Frames commands 

See ETSI TS 102 223 [32] clause 8.12.12. 

8.12.13 Additional information for SUBMIT and RETRIEVE MULTIMEDIA 
MESSAGE 

See ETSI TS 102 223 [32] clause 8.12.13. 

8.13 SMSTPDU 



Byte(s) 


Description 


Length 


1 


SMS TPDU tag 


1 


2to(Y-1)+2 


Length (X) 


Y 


(Y-1)+3to 
(Y-1)+X+2 


SMSTPDU 


X 



The TPDU is formatted as described in TS 23.040 [5]. 

Where the TPDU is being sent from the UICC to the ME (to be forwarded to the network), and where it includes a TP- 
Message-Reference which is to be incremented by the ME for every outgoing message, the TP -Message-Reference as 
provided by the UICC need not be the valid value. TP-Message-Reference shall be checked and corrected by the ME to 
the value described in TS 23.040 [5]. 



8.14 SS string 



Byte(s) 


Description 


Length 


1 


SS string tag 


1 


2to(Y-1)+2 


Length (X) 


Y 


(Y-1)+3 


TON and NPI 


1 


(Y-1)+4to 
(Y-1)+X+2 


SS or USSD string 


X-1 



TON/NPI and SS or USSD control string are coded as for EFadn, where the ADN record relates to a Supplementary 
Service Control string. See TS 31.102 [14] for the coding of EF^dn- 

8.15 Text string 

Content and coding is defined ETSI TS 102 223 [32] clause 8.15, with the following requirement: 
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Data coding scheme is coded as for SMS Data coding scheme defined in TS 23.038 [4]. Parts of the data coding scheme 
other than the character set indication shall be ignored. 

8.16 Tone 

See ETSI TS 102 223 [32] clause 8.16. 

NOTE: Standard supervisory tones for 3G are specified in TS 22.001 [22]. 



8.17 USSD string 



Byte(s) 


Description 


Length 


1 


USSD string tag 


1 


2to(Y-1)+2 


Length (X) 


Y 


(Y-1)+3 


Data coding scheme 


1 


(Y-1)+4to{Y- 
1)+X+2 


USSD string 


X-1 



The Data coding scheme is coded as for Cell Broadcast defined in TS 23.038 [4]. The coding of the USSD string is 
defined in TS 22.030 [2]. 

NOTE 1 : The MMI mode uses a 7 bit character set, the Application mode uses a 8 bit character set. 

NOTE2: The DCS is set to 0x96 to indicate that the USSD string is formatted according to TS 31.115 [41]. 

8.18 File List 

See ETSI TS 102 223 [32] clause 8.18. 

8.19 Location Information 



Byte(s) 


Description 


Length 


1 


Location Information tag 


1 


2 


Length = '09' or '07' or '05' or '00' (see Note 1 , Note 2 and 
Note 4) 


1 


3-5 


Mobile Country & Network Codes (MCC & MNC) 


3 


6-7 


Location Area Code/Tracking Area Code (LAC/TAC) 


2 


8-9 


Cell Identity Value (Cell ID) (see Note 2 and Note 3) 


2 


10-11 


Extended Cell identity Value (see Note 1 and Note 2) 


2 


NOTE 1 : The Extended Cell Identity Value is not available in GERAN. When in GERAN, this 
field shall not be present and the length field shall be set to "07". 

NOTE 2: When this object is used in the Network Rejection event download, the Cell Identity 
Value (Cell ID) and the Extended Cell Identity Value fields shall not be present and 
the length field shall be set to '05' 

NOTE 3: The E-UTRAN Cell Identifier (ECl) is coded on bytes 8 to 11 . 

NOTE 4: When PROVIDE LOCAL INFORMATION with command qualifier '13' is used and 
no surrounding macrocell is detected for an Access Technology, a location 
information data object with length set to '00' shall be present. 



The Mobile Country Code (MCC), the Mobile Network Code (MNC) and the Location Area Code (LAC) are coded as 
in TS 24.008 [9]. 

The Tracking Area Code (TAC) is coded as in TS 24.301 [46]. 

For GERAN, the Cell Identity Value is coded as in TS 24.008 [9]. 



£75/ 



3GPP TS 31 .1 1 1 version 1 1 .3.0 Release 1 1 



76 



ETSI TS 131 111 V1 1.3.0 (2012-10) 



For UTRAN, only the C-id part of the UC-id is returned in the Cell Identity Value (i.e. the 16 least significant bits of 
the UC-id), as defined in TS 25.401 [35] and TS 25.413 [36]. 

The Extended Cell identity Value is coded as the RNC-id part of the UC-id, as defined in TS 25.401 [35] and 

TS 25.413 [36]. It is left padded with zeros (this means that byte 10 contains the 4 most significant bits of the RNC-id 

value, and byte 1 1 contains the 8 least significant bits of the RNC-id value). 

For E-UTRAN, E-UTRAN Cell Identifier (ECI) is coded as defined in TS 36.401 [48]. ECI has a length of 28 bits. It is 
right padded with zeros (i.e. the most significant bit of ECI is coded on the most significant bit of byte 8. The least 
significant bit of ECI is coded on the 4* bit of byte 11. The 4 least significant bits of byte 1 1 shall be set to 1). 

8.20 IMEI 

See ETSI TS 102 223 [32] clause 8.20. 



8.21 Help Request 



See ETSI TS 102 223 [32] clause 8.21. 



8.22 Network Measurement Results 



Byte(s) 


Description 


Length 


1 


Network Measurement Results tag 


1 


2 


Length (X) of bytes following 


1 


3 - to X+2 


Network Measurement Results 


X 



For GERAN: The Network Measurement Results are coded as for the Measurement Results information element 
in TS 44.018 [27], starting at octet 2 (the lEI is removed, as this information is duplicated by the 
data object tag). The Length shall be set to TO' (16 decimal). 

For UTRAN; The Network Measurement Results are coded as for the "MeasurementReport" information 
element as defined in the ASN.l description of TS 25.331 [38], according to the following: 

- The "Measurement identity" field in the MEASUREMENT REPORT shall be set to the value '1'. 

- If "intra-frequency measurements" are requested by USIM, the ME shall, in the MEASUREMENT 
REPORT, include IE "Intra-frequency measured results list" in IE "Measured Results". The ME shall report 
CPICH Ec/No, CPICH RSCP and pathloss for the up to 6 strongest (highest Ec/No value) intra-frequency 
cells, if available in the ME according to TS 25.331 [38] and TS 25.133 [39]. 

- If "inter-frequency measurements" are requested by USIM, the ME shall, in the MEASUREMENT 
REPORT, include IE "inter-frequency measured results list" in IE "Measured Results". The ME shall report 
CPICH Ec/No, CPICH RSCP and pathloss for the up to 6 strongest (highest Ec/No value) inter-frequency 
cells per monitored frequency, if available in the ME according to TS 25.331 [38] and TS 25.133 [39]. 

- If "inter-RAT (GERAN) measurements" are requested by USIM, the ME shall, in the MEASUREMENT 
REPORT, include IE "inter-RAT measured results list" in IE "Measured Results". The ME shall report GSM 
carrier RSSI for the up to 6 strongest (highest RSSI value) inter-RAT GSM cells (identified by the BCCH 
ARFCN), if available in the ME according to TS 25.331 [38] and TS 25.133 [39]. 

- If "inter-RAT (E-UTRAN)" are requested by USIM, the ME shall, in the MEASUREMENT REPORT, 
include IE "E-UTRA measured results". The ME shall report RSRP and RSRQ for the up to 4 strongest 
(highest RSRQ value) inter-RAT E-UTRAN cells per monitored frequency, if available in the ME according 
to TS 25.331 [38] and TS 25.133 [39]. 

- All other optional fields in the MEASUREMENT REPORT shall be set to be absent. 
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For E-UTRAN: The Network Measurement Results are coded as for the MeasurementReport information element 
as defined in the ASN.l description of TS 36.331 [49], according to the following: 

The "measid" field in the "measResults" shall be set to the value '1'. 

- the ME shall include IE "measResultServCell" with RSRP and RSRQ of the serving cell. 

If "intra-frequency measurements" are requested by USIM, the ME shall, in the MeasurementReport, include 
IE "measResultListEUTRA" in IE "measuredResults". The ME shall report RSRP, RSRQ, Physical Cell ID 
and IE "cgi-Info" for the up to 6 strongest (highest RSRQ value) intra-frequency cells, if available in the ME 
according to TS 36.331 [49] and TS 36.133 [50]. 

If "inter-frequency measurements" are requested by USIM, the ME shall, in the MeasurementReport, include 
IE " measResultListEUTRA" in IE "Measured Results". The ME shall report RSRP, RSRQ, Physical Cell ID 
and IE "cgi-Info" for the up to 6 strongest (highest RSRQ value) inter-frequency cells per monitored 
frequency, if available in the ME according to TS 36.331 [49] and TS 36.133 [50]. 

If "inter-RAT (UTRAN) measurements" are requested by USIM, the ME shall, in the MeasurementReport, 
include IE " measResultListUTRA" in IE "Measured Results". The ME shall report CPICH Ec/No, CPICH 
RSCP, Physical Cell ID and IE "cgi-Info" for the up to 6 strongest (highest Ec/No value) inter-RAT UTRAN 
cells per monitored frequency, if available in the ME according to TS 36.331 [49] and TS 36.133 [50]. 

If "inter-RAT (GERAN) measurements" are requested by USIM, the ME shall, in the MeasurementReport, 
include IE "measResultListGERAN" in IE "Measured Results". The ME shall report GERAN carrier RSSI 
and Physical Cell ID for the up to 6 strongest (highest RSSI value) inter-RAT GERAN cells (identified by 
the BCCH ARFCN) and IE "cgi-Info", if available in the ME according to TS 36.331 [49] and 
TS 36.133 [50]. 

All other optional fields in the MeasurementReport shall be set to be absent. 

8.23 Default Text 

See ETSI TS 102 223 [32] clause 8.23. 

8.24 Items Next Action Indicator 

See ETSI TS 102 223 [32] clause 8.24. 

8.25 Event list 

For the event list byte coding, the following value are defined in addition to those in ETSI TS 102 223 [32] clause 8.25: 

- '1 r = I-WLAN Access Status. 
'12' = Network Rejection 

- '15' = CSG cell selection 

- '17' = IMS Registration 

- '18' = Incoming IMS data 



8.26 Cause 



Byte(s) 


Description 


Length 


1 


Cause tag 


1 


2 


Length (X) of bytes following. X=0, or 2 < X < 30. 


1 


3 to X+2 


Cause 


X 
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The Cause data object is coded as for the Cause call control information element in TS 24.008 [9], starting at octet 3 
(the lEI and Length information are removed, as this information is duplicated by the data object tag and length). 

Radio Link Timeout is indicated by the Cause data object having a value part of zero length (only the Tag and Length 
components are sent). 

8.27 Location status 

See ETSI TS 102 223 [32] clause 8.27. 



8.28 Transaction identifier 



Byte(s) 


Description 


Length 


1 


Transaction identifier tag 


1 


2 


Length (X) of bytes following 


1 


3 to X+2 


Transaction identifier list 


X 



Transaction identifier list: 

Contents: 

A list of transaction identifiers, of variable length. Each byte in the list defines a transaction identifier. Each 
transaction identifier shall not appear more than once within the list; 

Coding: 

Each byte in the transaction identifier list shall be coded as defined below: 

bits 1 to 4 = RFU; 

bits 5 to 7 = TI value; 

bit 8 = TI flag. 

TI value and TI flag are coded as defined in TS 24.007 [8]. 

8.29 BCCH channel list 

This information is only available when the ME is connected to a GSM access network. 



Byte(s) 


Description 


Length 


1 


BCCH channel list tag 


1 


2 


Length (X) of bytes following 


1 


3 to X+2 


BCCH channel list 


X 



BCCH channel list: 



Contents: 



The list of absolute RF channels for BCCH carriers, as known by the ME from the SYSTEM 
INFORMATION messages. The BCCH channel list is composed of one to three BCCH channel sub lists, 
each sub list is derived from the set of frequencies defined by reference neighbour cells description 
information element or elements. In the latter case the set is the union of the different subsets defined by the 
neighbour cells description information elements (see TS 44.018 [27]). The length of the BCCH channel list 
field depends on the length of the received BCCH channel list derived from the different SYSTEM 
INFORMATION messages to be considered. 

Coding: 

Each ARFCN is represented by 10 bits. Spare bit(s) are to be filled with 0. 
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Bytel 
Byte 2 
Byte 3 



Bit 8 Bit 7 Bit 6 


1 Bits 1 Bit 4 1 Bit 3 | Bit 2 | 


Biti 1 


ARFCN#1 (high part) | 


ARFCN#1 (low part) 


ARFCN#2 (high part) 




ARFCN#2 (low part) 


ARFCN#3 (high part) 





Byte X-1 
ByteX 



ARFCN#m-1 (low part) 



ARFCN#m (low part) 



ARFCN#m (high part) 



Spare bit 

(0) 



Spare bit 
(0) 



8.30 Call control requested action 



Byte(s) 


Description 


Length 


1 


Call control requested action tag 


1 


2to(Y-1)+2 


Length (X) 


Y 


(Y-1)+3to(Y- 
1)+X+2 


Call control requested action 


X 



Call control requested action: 

Contents: 

The action given in response to the ENVELOPE (CALL CONTROL). It may contain, in the same order as 
given by the UICC, the address or SS string, the capability configuration parameters, the called party sub- 
address and the alpha identifier, or the IMS Request-URI; 

Coding: 

As described in clause 7.3.1.6, starting with the first optional element given in the response data to the 
ENVELOPE (CALL CONTROL). 

8.31 Icon Identifier 

See ETSI TS 102 223 [32] clause 8.31. 

8.32 Item Icon Identifier list 

See ETSI TS 102 223 [32] clause 8.32. 

8.33 Card reader status 

See ETSI TS 102 223 [32] clause 8.33. 

8.34 Card ATR 

See ETSI TS 102 223 [32] clause 8.34. 



8.35 C-APDU 



See ETSI TS 102 223 [32] clause 8.35. 



8.36 R-APDU 



See ETSI TS 102 223 [32] clause 8.36. 
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8.37 Timer identifier 

See ETSI TS 102 223 [32] clause 8.37. 

8.38 Timer value 

See ETSI TS 102 223 [32] clause 8.38. 

8.39 Date-Time and Time zone 

See ETSI TS 102 223 [32] clause 8.39. 

NOTE: coding is as for the Time Zone and Time information element in TS 24.008 [9], starting at octet 2. 

8.40 AT Command 



Byte(s) 


Description 


Length 


1 


AT Command tag 


1 


2to(Y-1)+2 


Length (X) 


Y 


(Y-1)+3to{Y- 
1)+3+X-1 


AT Command string 


X 



Contents: 



The AT Command string is structured exactly as the AT Command line as defined in TS 27.007 [12], which may 
contain single or concatenated AT commands. 



8.41 AT Response 



Byte(s) 


Description 


Length 


1 


AT Response tag 


1 


2to(Y-1)+2 


Length (X) 


Y 


(Y-1)+3to{Y- 
1)+3+X-1 


AT Response string 


X 



Contents: 



The AT Response string is structured exactly as the response to a command line as defined in TS 27.007 [12], 
which may contain single or concatenated responses appropriate to the issued AT command. 

If the AT Response string is longer than the maximum length capable of being transmitted to the UICC then the 
AT Response string shall be truncated to this length by the ME. 



8.42 BC Repeat indicator 



Byte(s) 


Description 


Length 


1 


BC repeat indicator tag 


1 


2 


Length 


1 


3 


BC repeat indicator values 


1 



Contents & coding: 

The BC repeat indicator is structured exactly as defined in TS 24.008 [08]. 
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8.43 Immediate response 

See ETSI TS 102 223 [32] clause 8.43. 

8.44 DTMF string 

See ETSI TS 102 223 [32] clause 8.44. 

8.45 Language 

See ETSI TS 102 223 [32] clause 8.45. 

8.46 Timing Advance 

This information is only available when the ME is connected to a GSM access network. 



Byte(s) 


Description 


Length 


1 


Timing Advance tag 


1 


2 


Length = '02' 


1 


3 


ME Status 


1 


4 


Timing Advance 


1 



Coding of ME status: 

- '00' = ME is in the idle state; 

'Or = ME is not in idle state; 

'02' to'FF'= reserved values. 

The Timing Advance is coded as for the Timing Advance information element in TS 44.018 [27], starting at octet 2 (the 
lEI is removed, as this information is duplicated by the data object tag). 

8.47 Browser Identity 

See ETSI TS 102 223 [32] clause 8.37. 

8.48 URL 

See ETSI TS 102 223 [32] clause 8.48. 

8.49 Bearer 



Byte(s) 


Description 


Length 


1 


Bearer tag 


1 


2 to (Y + 1 ) 


Length (X) 


Y 


(Y+2)to(Y + X+1) 


List of bearers in order of priority requested 


X 



The ME shall use this list to choose which bearers are allowed in order of priority. 
Coding of the bearers: 

- '00' = SMS; 

- '01' = CSD; 
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- '02' = USSD; 

- '03' = GPRS/UTRAN packet service/E-UTRAN; 

- '04' to 'FF' = RFU. 

8.50 Provisioning File Reference 

See ETSI TS 102 223 [32] clause 8.50. 

8.51 Browser Termination Cause 

See ETSI TS 102 223 [32] clause 8.51. 

8.52 Bearer description 



ETSI TS 131 111 V1 1.3.0 (2012-10) 



Byte(s) 


Description 


Length 


1 


Bearer description tag 


1 


2 


Length (X+1) 


1 


3 


Bearer type 


1 


4 to (3+X) 


Bearer parameters 


X 



Bearer Type coding: in addition to the values defined in ETSI TS 102 223 [32], the following are defined: 
'01' = CSD; 

'02' = GPRS / UTRAN packet service / E-UTRAN. 

'09' = UTRAN packet service with extended parameters / HSDPA / E-UTRAN. 
'OA' = I-WLAN. 

'OB' = E-UTRAN / mapped UTRAN packet service. 
- Bearer parameters coding: see the following clauses. 

8.52.1 Bearer parameters for CSD 

Contents: parameters specific to the bearer. 

In this case X=3. 

NOTE: The default values of the subparameters are manufacturer specific since they depend on the purpose of the 
device and data services provided by it. Not all combinations and values of these subparameters are 
supported by GSM (see TS 22.002 [1]). 

Coding: 

The following values are as defined in the TS 27.007 [12] for the select service bearer type "h-CBST" extended 
command. They are coded in hexadecimal. 

Coding of Byte 4: 

Data rate: same as the "speed" subparameter defined in TS 27.007 [12]. 
Coding of byte 5: 

Bearer service: same as the "name" subparameter defined in TS 27.007 [12]. 
Coding of Byte 6: 
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Connection element: same as the "ce" subparameter defined in TS 27.007 [12]. 

8.52.2 Bearer parameters for GPRS/UTRAN Packet Service/E-UTRAN 

Contents: parameters describing the Quality of Service (QoS) and the type of PDP. This is an element of the PDP 
context. These parameters can be used for 2G or 3G packet service. 

In this case X=6. 

Coding: 

The following values are as defined in the TS 27.007 [12], for the "+CGQREQ" extended command. They are 
coded in hexadecimal. 

Coding of Byte 4: 

Precedence class: same as the "precedence" subparameter, defined in TS 27.007 [12]. 
Coding of Byte 5: 

Delay class: same as the "delay" subparameter, defined in TS 27.007 [12]. 
Coding of Byte 6: 

Reliability class: same as the "reliabiUty" subparameter, defined in TS 27.007 [12]. 
Coding of Byte 7: 

Peak throughput class: same as the "peak" subparameter, defined in TS 27.007 [12]. 
Coding of Byte 8: 

Mean throughput class: same as the "mean" subparameter, defined in TS 27.007 [12]. 
Coding of Byte 9: 

Packet data protocol type: 

'02' = IP (Internet Protocol, IETF STD 5); 

all other values are reserved. 
Note: The mapping between the UTRAN and E-UTRAN QoS parameters are defined in TS 23.203 [47]. 

8.52.3 Bearer parameters for UTRAN Packet Service with extended 
parameters / HSDPA / E-UTRAN 

Contents: parameters describing the Quality of Service (QoS) and the type of PDP. This is an element of the PDP 
context. 

In this case X=17. 

Coding: 

The following values are as defined in the TS 27.007 [12], for the "+CGEQREQ" extended command. They are 
coded in hexadecimal. 

Coding of Byte 4: 

Traffic class: same as the "Traffic class" subparameter, defined in TS 27.007 [12]. 
Coding of Byte 5 and 6: 

Maximum bitrate UL: same as the "Maximum bitrate UL" subparameter, defined in TS 27.007 [12]. 
Coding of Byte 7 and 8: 
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Maximum bitrate DL: same as the "Maximum bitrate DL" subparameter, defined in TS 27.007 [12]. 
Coding of Byte 9 and 10: 

Guaranteed bitrate UL: same as the "Guaranteed bitrate UL" subparameter, defined in TS 27.007 [12]. 
Coding of Byte 11 and 12: 

- Guaranteed bitrate DL: same as the "Guaranteed bitrate DL" subparameter, defined in TS 27.007 [12]. 
Coding of Byte 13: 

Delivery order: same as the "Delivery order" subparameter, defined in TS 27.007 [12]. 
Coding of Byte 14: 

Maximum SDU size: same as the "Maximum SDU size" subparameter, defined in TS 27.007 [12]. 
Coding of Byte 15: 

SDU error ratio: same as the "SDU error ratio" subparameter, defined in TS 27.007 [12]. 
Coding of Byte 16: 

Residual bit error ratio: same as the "Residual bit error ratio" subparameter, defined in TS 27.007 [12]. 

Coding of Byte 17: 

Delivery of erroneous SDUs: same as the "Delivery of erroneous SDUs" subparameter, defined in 
TS 27.007 [12]. 

Coding of Byte 18: 

Transfer delay: same as the "Transfer delay" subparameter, defined in TS 27.007 [12]. 
Coding of Byte 19: 

Traffic handling priority: same as the "Traffic handling priority" subparameter, defined in TS 27.007 [12]. 
Coding of Byte 20: 

- PDP_type: same as the "PDP_type" subparameter, defined in TS 27.007 [12]. 

Note 1 : HSDPA parameters and UTRAN Packet Service parameters are the same except for the maximum bitrate 
DL and the guaranteed bitrate DL, which can be higher for HSDPA (see TS 24.008 [9]). 

Note 2: The mapping between the UTRAN and E-UTRAN QoS parameters are defined in TS 23.203 [47]. 

8.52.4 Bearer parameters for l-WLAN 

Content: parameters specific to the bearer. RFU. 
In this case X=0 

8.52.5 Bearer parameters for E-UTRAN / mapped UTRAN packet service 

Contents: parameters describing the Quality of Service (QoS) and the type of PDP. This is an element of the PDP 
context. 

In this case X=2 or X=6 or X=10, depending on the size of the "EPS quality of service" information element and the 
resource type (GBR or non-GBR). 

In case of a non-GBR QCI, the QoS octets in the "EPS quality of service" information element are ignored by the UE, 
as specified in TS 24.301 [46]. In this case, the UE shall use X=2, passing only the QCI value. 

Coding of Byte 4 to Byte X+2: 
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Byte 4 same as "octet 3" of the "EPS quality of service" information element, defined in TS 24.301 [46]. 

For a GBR QCI each subsequent Byte shall be present only if the corresponding next octet in the "EPS quality of 
service" information element is present. The coding of the corresponding bytes shall be the same. 

Coding of Byte X+3: 

- PDP_type: same as the "PDP_type" subparameter, defined in TS 27.007 [12]. 

8.53 Channel data 

See ETSI TS 102 223 [32] clause 8.53. 

8.54 Channel data length 

See ETSI TS 102 223 [32] clause 8.54. 

8.55 Buffer size 

See ETSI TS 102 223 [32] clause 8.55. 

8.56 Channel status 

ETSI TS 102 223 [32] clause 8.56 applies, with the following addition. 
In case of an OPEN CHANNEL for IMS, the coding is as follows: 
Coding : 
-byte 3 : 

- Bit 1 to 3 : Channel identifier 1 to 7; 

Channel identifier means "no channel available". 
- Bit 4 to 7 : RFU 

Bit 8 : = BIP channel not estabHshed; 
1 = BIP channel established. 

- byte 4: 

'00' = No further info can be given; 

'01' = Not used; 

'02' = Not used; 

'03' = Not used; 

'04' = Not used; 

'05' = Link dropped (network failure or user cancellation); 

all other values are reserved. 



8.57 Card reader identifier 

See ETSI TS 102 223 [32] clause 8.57. 
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8.58 Other Address 



See ETSI TS 102 223 [32] clause 8.58. 



8.59 U ICC/ME interface transport level 



See ETSI TS 102 223 [32] clause 8.59. 



8.60 AID 



See ETSI TS 102 223 [32] clause 8.60. 



8.61 Network Access Name 



Byte(s) 


Description 


Length 


1 


Network Access Name tag 


1 


2 


Length (X) 


1 


3 to 3+X-1 


Network Access Name 


X 



Content: 

The Network Access Name is used to identify the Gateway entity (GGSN) or a Packet Data Network Gateway 
(PDN-GW), which provides interworking with an external packet data network. For GPRS, UTRAN packet 
service and E-UTRAN, the Network Access Name is an APN. 

Coding: 

- As defined in TS 23 .003 [30] . 

8.62 Access Technology 

See ETSI TS 102 223 [32] clause 8.61. 

8.63 Display parameters 

See ETSI TS 102 223 [32] clause 8.62. 



8.64 Service Record 

See ETSI TS 102 223 [32] clause 8.63. 

8.65 Device Filter 

See ETSI TS 102 223 [32] clause 8.64. 

8.66 Service Search 

See ETSI TS 102 223 [32] clause 8.65. 

8.67 Attribute Information 

See ETSI TS 102 223 [32] clause 8.66. 
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8.68 Service Availability 

See ETSI TS 102 223 [32] clause 8.67. 

8.69 Remote Entity Address 

See ETSI TS 102 223 [32] clause 8.68. 

8.70 Text Attribute 

See ETSI TS 102 223 [32] clause 8.72. 

8.71 Item Text Attribute List 

See ETSI TS 102 223 [32] clause 8.73. 

8.72 PDP context Activation parameters 



Byte(s) 


Description 


Length 


1 


PDP context Activation parameters tag 


1 


2 


Length (X) 


1 


3 to X+2 


PDP context Activation parameters 


X 



The PDP context Activation parameters are coded as the ACTIVATE PDP CONTEXT REQUEST message, refer to 
TS 24.008 [9]. 

8.73 UTRAN/E-UTRAN Measurement Qualifier 

This information is only available when the ME is connected to a UTRAN or an E-UTRAN. 



Byte(s) 


Description 


Length 


1 


UTRAN/E-UTRAN Measurement Qualifier tag 


1 


2 


Length (1) 


1 


3 


UTRAN/E-UTRAN Measurement Qualifier 


1 



UTRAN/E-UTRAN Measurement Qualifier 

Contents: Quahfier specific to the UTRAN/E-UTRAN NMR 
Coding 



'01' 
'02' 
'03' 
'04' 
'05' 
'06' 
'07' 
'08' 



UTRAN Intra-frequency measurements 
UTRAN Inter-frequency measurements 
UTRAN Inter-RAT (GERAN) measurements 
UTRAN Inter-RAT (E-UTRAN) measurements 
E-UTRAN Intra-frequency measurements 
E-UTRAN Inter-frequency measurements 
E-UTRAN Inter-RAT (GERAN) measurements 
E-UTRAN Inter-RAT (UTRAN) measurements 



All other values are reserved 
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8.74 Multimedia IVIessage Reference 



See ETSI TS 102 223 [32] clause 8.82. 



8.75 IVIultimedia IVIessage Identifier 



See ETSI TS 102 223 [32] clause 8.83. 

8.76 Multimedia Message Transfer status 

See ETSI TS 102 223 [32] clause 8.84. 

8.77 MM Content Identifier 

In addition to ETSI TS 102 223 [32] clause 8.85, the codinf of the MM Content Data Object tag is done according to TS 

31.102[14]. 

8.78 Multimedia Message Notification 

See ETSI TS 102 223 [32] clause 8.86. 

8.79 Last Envelope 

See ETSI TS 102 223 [32] clause 8.87. 

8.80 Frames Layout 

See ETSI TS 102 223 [32] clause 8.78. 

8.81 Frames Information 

See ETSI TS 102 223 [32] clause 8.79. 

8.82 Frames identifier 

See ETSI TS 102 223 [32] clause 8.80. 

8.83 l-WLAN Identifier 



Byte(s) 


Description 


Length 


1 


l-WLAN Identifier tag 


1 


2 


Length (X) 


1 


3 to (2+X) 


WSID value 


X 



The WSID Value is coded as the WLAN Specific Identifier (WSID) defined in TS 24.234 [42]. 
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8.84 l-WLAN Access Status 



Byte(s) 


Description 


Length 


1 


l-WLAN Access Status tag 


1 


2 


Length (1) 


1 


3 


Access status 


1 



Coding of Access status: 

'00' = No current I-WLAN coverage; 
'01' = l-WLAN coverage available, no current connection; 
'02' = l-WLAN coverage available, connection on-going; 
'03' to'FF'= reserved values. 

8.85 IMEISV 

See ETSI TS 102 223 [32] clause 8.74. 

8.86 Network search mode 

See ETSI TS 102 223 [32] clause 8.75. 



8.87 Battery State 

See ETSI TS 102 223 [32] clause 8.76. 

8.88 Browsing status 



See ETSI TS 102 223 [32] clause 8.77. 



8.89 Registry application data 

See ETSI TS 102 223 [32] clause 8.88. 



8.90 PLIVINwAcT List 



Byte(s) 


Description 


Length 


1 


PLMNwAcT List tag 


1 


2 


Length (5n) 


1 


3 to 5 


I""' PLMN ldentifier(highest priority) 


3 


6 to 7 


1^' PLIVIN Access Technology Identifier 


2 








(5n-2) to (5n) 


nth PLIVIN Identifier (lowest priority) 


3 


(5rn-1)to(5n-^2) 


nth PLIVIN Access Technology Identifier 


2 



Coding of PLMN Identifier: 

As for PLMN within EFplmnwact in TS 31.102 [14]. 
Coding of PLMN Access Technology Identifier: 

As for Access Technology Identifier within EFplmnwact in TS 31.102 [14]. 
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8.91 Routing Area Identification 



Byte(s) 


Description 


Length 


1 


Routing Area Information Tag 


1 


2 


Length 


1 


3-5 


IVIobile Country & Networl< Codes (IVICC & IVINC) 


3 


6-7 


Location Area Code (LAC) 


2 


8 


Routing Area code (RAC) 


1 



When present, this object shall contain the Routing Area Identification information of rejecting network. The RAI is 
coded in the same manner as the value part of the Routing Area Identification information element as specified in TS 
24.008 [9]. 



8.92 Update/Attach Type 



Byte(s) 


Description 


Length 


1 


Update/Attach Type Tag 


1 


2 


Length 


1 


3 


Update/Attach Type 


1 



Contents: 

In the case of GERAN/UTRAN, the terminal shall use this information as a mechanism to indicate to the 
UICC the location updating type that was sent in the LOCATION UPDATING REQUEST MESSAGE 
or the update type that was sent in the GPRS ATTACH REQUEST or ROUTING AREA UPDATING 
REQUEST message, as specified in TS 24.008 [9]. 

In the case of E-UTRAN, the terminal shall use this information as a mechanism to indicate to the UICC 
the EPS attach type that was sent in the ATTACH REQUEST or TRACKING AREA UPDATE 
REQUEST message, as specified in TS 24.301 [46]. 

Coding: 

'00' = "Normal Location Updating" in the case of a LOCATION UPDATING REQUEST message; 

'01' = "Periodic Updating" in the case of a LOCATION UPDATING REQUEST message; 

'02' = "IMSI Attach" in the case of a LOCATION UPDATING REQUEST message; 

'03' = "GPRS Attach" in the case of a GPRS ATTACH REQUEST message; 

'04' = "Combined GPRS/IMSI Attach" in the case of a GPRS ATTACH REQUEST message; 

'05' = "RA Updating" in the case of a ROUTING AREA UPDATE REQUEST message; 

'06' = "Combined RA/LA Updating" in the case of a ROUTING AREA UPDATE REQUEST message; 

'07' = "Combined RA/LA Updating with IMSI Attach" in the case of a ROUTING AREA UPDATE 
REQUEST message; 

'08' = "Periodic Updating" in the case of a ROUTING AREA UPDATE REQUEST message 

'09' = "EPS Attach" in the case of an EMM ATTACH REQUEST message 

'OA' = "Combined EPS/IMSI Attach" in the case of an EMM ATTACH REQUEST message 

'OB' = "TA updating " in the case of an EMM TRACKING AREA UPDATE REQUEST message 

'OC = "Combined TA/LA updating" in the case of an EMM TRACKING AREA UPDATE REQUEST 
message 

'OD' = "Combined TA/LA updating with IMSI attach" in the case of an EMM TRACKING AREA 
UPDATE REQUEST message 
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'OE' = "Periodic updating" in the case of an EMM TRACKING AREA UPDATE REQUEST message 
All other values are reserved for future use 



8.93 Rejection Cause Code 



Byte(s) 


Description 


Length 


1 


Rejection Cause Code Tag 


1 


2 


Length 


1 


3 


Rejection Cause Code 


1 



For GERAN/UTRAN, in the case of a LOCATION UPDATING REJECT message, this object shall contain the Reject 
Cause as received in the LOCATION UPDATING REJECT message. The Reject Cause is coded in the same manner as 
the value part of the Reject Cause information element as specified in TS 24.008 [9] 

For GERAN/UTRAN, in the case of a GPRS ATTACH REJECT message or a ROUTING AREA UPDATE REJECT 
message, this object shall contain the GMM Cause as received in the GPRS ATTACH REJECT message or ROUTING 
AREA UPDATE REJECT message. The GMM Cause is coded in the same manner as the value part of the GMM 
Cause information element as specified in TS 24.008 [9]. 

For E-UTRAN, in the case of an EMM ATTACH REJECT message or an EMM TRACKING AREA UPDATE 
REJECT message, this object shall contain the EMM Cause are received in the EMM ATTACH REJECT message or 
EMM TRACKING AREA UPDATE REJECT message. The EMM Cause is coded in the same manner as the value part 
of the EMM Cause information element as specified in TS 24.301 [46]. 

8.94 Geographical Location Parameters 



Byte(s) 


Description 


Length 


1 


Geographical Location Parameters Tag 




2 


Length 




3 


Horizontal accuracy 




4 


Vertical coordinate 




5 


Velocity 




6 


Preferred GAD shapes 




7 


Preferred NMEA sentences 




8 


Preferred Maximum Response Time 





Horizontal accuracy: 
Contents: 



the preferred horizontal accuracy. 



Coding: 



'81': horizontal accuracy not specified / best effort; 

'xx' where '00' < 'xx' < '7F': 'xx' represents the uncertainty for longitude and latitude as described in TS 
23.032 [44]. A value in this range may be specified in the parameters of the "Geographical Location 
Request" command. The horizontal location error should be less than the error indicated by the horizontal 
accuracy with 67% confidence. 

All other values are reserved. 



Vertical coordinate: 
Contents: 
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indicates if the vertical coordinate (altitude) is requested and potentially indicate the preferred vertical 
coordinate accuracy. 



Coding: 



'80': 



vertical coordinate is not requested (i.e. 2D location fix is acceptable); 



'81': vertical coordinate is requested, (i.e. 3D location fix is preferred) but accuracy is not specified (best 
effort); 

'xx' where '00' < 'xx' < '7F': vertical coordinate is requested and 'xx' represents the altitude uncertainty as 
described in TS 23.032 [44]. A value in this range may be specified in the parameters of the "Geographical 
Location Request" command. The vertical location error should be less than the error indicated by the 
vertical accuracy with 67% confidence. 



All other values are reserved. 



Velocity: 
Contents: 



indicates if a velocity and a velocity uncertainty are requested. When a velocity type or an uncertainty are 
requested, the corresponding bit shall be set to 1. Otherwise the bit is set to 0. If bl is set to zero, b2, b3 and 
b4 shall be ignored. If b2 is set to zero, b4 shall be ignored. 



Coding: 



b8 



bG B5 b4 b3 b2 bl 



Horizontal velocity requested 

Vertical velocity requested 

Uncertainty of horizontal velocity requested 

Uncertainty of vertical velocity requested 

RFU, bit = 

RFU, bit = 

RFU, bit = 

RFU, bit = 



Preferred GAD shapes: 
Contents: 



the preferred GAD shape(s). When a GAD shape is indicated as "preferred", the corresponding bit shall be 
set to 1 . Otherwise the bit is set to 0. The UICC application should be capable of extracting the needed 
information from all GAD shapes indicated in the bit map below. 



Coding: 



b8 



be B5 b4 b3 b2 bl 



Ellipsoid point 

Ellipsoid point with uncertainty circle 

Ellipsoid point with uncertainty ellipse 

Ellipsoid point with altitude 

Polygon 

Ellipsoid point with altitude and uncertainty 

ellipsoid 

Ellipsoid arc 

RFU, bit = 



Preferred NMEA sentences: 
Contents: 



the preferred NMEA sentence(s). When a NMEA sentence is indicated as "preferred", the corresponding bit 
shall be set to 1 . Otherwise the bit is set to 0. The UICC application should be capable of extracting the 
needed information from all NMEA sentences indicated in the bit map below. 
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Coding: 



b8 B7 b6 B5 b4 b3 b2 bl 



$--RMC 




$--GGA 




$--GLL 




$--GNS 




RFU, bit = 


= 


RFU, bit = 


= 


RFU, bit = 


= 


RFU, bit = 


= 



Preferred Maximum Response Time: 

Contents: 

indicates the preferred maximum response time. This hint may be used by the ME to make trade-offs 
between requirements for positioning accuracy and response time. 

Coding: 

'xx' where '02' < 'xx' < '07': 2'^"" represents the preferred maximum response time in seconds. 

All other values are reserved; 



8.95 GAD shapes 



Byte(s) 


Description 


Length 


1 


GAD shapes Tag 


1 


2 


Length 


1 


3 


Length of GAD shape 


1 


4 to X+3 


GAD shape 


X 


X+4 


Length of Velocity 


1 


X+5 to X+Y+4 


Velocity 


Y 



Length of GAD shape: 

Contents: 

- the length of the GAD shape. 

Coding: 

binary. 

GAD shape: 

Contents: 

universal geographical area description shape. 

Coding: 

a) - shape encoded as described in TS 23.032 [44] with the first byte of the shape (i.e. octet 1 containing the type 
shape) encoded on byte 4. 

Length of Velocity: 

Contents: 

the length of the velocity. This byte shall be set to '00' when the Velocity is not available. 
Coding: 

binary. 
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Velocity: 
Contents: 



velocity. 

Coding: 

velocity encoded as described in TS 23.032 [44] with the first byte of the velocity (i.e. octet 1 containing the 
velocity shape) encoded on byte X+5. 

8.96 NMEA sentence 



Byte(s) 


Description 


Length 


1 


NMEA sentence Tag 


1 


2 


Length 


1 


3 to X+2 


NMEA sentence 


X 



NMEA sentence: 
Contents: 



NMEA sentence as defined in lEC 61162-1 [45]. The ME should use one of the Preferred NMEA sentences 
indicated in the "Geographical Location Parameters" by the UICC. Otherwise, one of the NMEA sentences 
listed in section 8.94 shall be used. 



Coding: 
ASCII; 



8.97 PLMN List 



Byte(s) 


Description 


Length 


1 


PLMN List tag 


1 


2 


Length (3n) 


1 


3 to 5 


1^' PLMN ldentifier(highest priority) 


3 








(3n) to (3n+2) 


nth PLMN Identifier (lowest priority) 


3 



Coding of PLMN Identifier: 

As for PLMN within EFqplmnwlan in TS 31.102 [14]. 



8.98 EPS PDN connection activation parameters 



Byte(s) 


Description 


Length 


1 


EPS PDN connection Activation parameters tag 


1 


2 


Length (X) 


1 


3 to X+2 


EPS PDN connection Activation parameters 


X 



The EPS PDN connection Activation parameters are coded as the PDN CONNECTIVITY REQUEST message, refer to 
TS 24.301 [46]. 

Note: If the "Protocol configuration options" in the PDN CONNECTIVITY REQUEST message is too large (i.e. 
greater than 219-L, where L is the length of the Access point name Information Element), the ME may decide 
not to include the "Protocol configuration options" inside the "EPS PDN connection Activation parameters". 
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8.99 Tracking Area Identification 



Byte(s) 


Description 


Length 


1 


Tracking Area Identification Tag 


1 


2 


Length 


1 


3-5 


IVlobile Country & Networl< Codes (IVICC & IVINC) 


3 


6-7 


Tracl<ing Area Code (TAC) 


2 



This object shall contain the Tracking Area Identification information of rejecting network (i.e. MCC, MNC and TAC). 
The value part of this object is coded in the same manner as the value part of the Tracking Area Identity information 
element as specified in TS 24.301 [46]. 

8.100 CSG ID list identifier 



Byte(s) 


Description 


Length 


1 


CSG ID list Identifier tag 


1 


2 to UY 


Length 


Y 


Y+3 to Y+X+2 


CSG ID List 


X(X>1) 



CSG ID List: 



Description 


Value 


IVI/0 


Length (bytes) 


PLMN Tag 


'80' 


M 


1 


Length 


A 


M 


1 


PLMN 


- 


M 


A 


CSG ID and Name Tag 


'81' 


M 


1 


Length 


B 


M 


1 


CSG ID and Name 


- 


M 


B 



The CSG ID List TLV object shall contain one PLMN TLV object, Tag '80', followed by at least one CSG ID and 
Name TLV, Tag '81'. The CSG ID List TLV object can contain more than one PLMN TLV objects. Each CSG ID and 
Name TLV belongs to the previous PLMN. 

Coding of PLMN object (Tag '80'): 

Content: 

Mobile Country Code (MCC) followed by the Mobile Network Code (MNC). 

Coding: 

according to TS 24.008 [9]. 

Coding of CSG ID and name (Tag '81'): 

Content: 

CSG ID and HNB Name 

Coding: 



1 to 4 


CSG ID 


M 


4 bytes 


5toB 


HNB Name 


M 


B-4 bytes 



CSG ID: as in EFacsgl, in TS 31.102 [14]. 

HNB Name: as for HNB name in EFhnbn in TS 31.102 [14]. 
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8.101 CSG cell selection status 



Byte(s) 


Description 


Length 


1 


CSG cell selection status tag 


1 


2 


Length 


1 


3 


CSG cell selection status 


2 



Coding of CSG cell selection status: 
Byte 1 : general information 

- '00' = not camped on a CSG or Hybrid cell in the Allowed CSG list or the Operator CSG list 

- 'Or = camped on a CSG or Hybrid cell of the Operator CSG list or Allowed CSG Ust 

- other values are RFU 

Byte 2 : additional information 

This byte may contain additional information. If additional information is present, bit bl shall be set to 1. If bl is 
set to 0, this byte shall be ignored. 



B8 b7 b6 b5 b4 b3 b2 bl 



Additional information presence bit 

RFU 

RFU 

RFU 

RFU 

RFU 

Result of a manual CSG selection 

Result of an autonomous search function 



8.102 CSG ID 



Byte(s) 


Description 


Length 


1 


CSG ID tag 


1 


2 


Length 


1 


3 to X+2 


CSG ID 


X 



Coding of CSG ID: 

As for CSG ID in EFacsgl, in TS 31.102 [14] 

8.103 HNBname 



Byte(s) 


Description 


Length 


1 


HNB name tag 


1 


2 


Length 


1 


3 to 2+X 


HNB name 


X 



Coding of HNB name: 

As for HNB name in EFhnbn in TS 31.102 [14] 
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8.1 05 Broadcast Network information 

Not required by 3GPP. 

8.106 Contactless state request 

Not required by 3GPP. 

8.1 07 Contactless functionality state 

Not required by 3GPP. 

8.108 IMS Request-URI 
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Byte(s) 


Description 


Length 


1 


IMS Request-URI Tag 


1 


2 


Length 


1 


3 to X+2 


IMS Request-URI (IMPU) 


X 



Content : 

IMS Request-URI shall take the form of IMPU, which is SIP URI or tel URI, as defined in TS 24.229 [X] 
Coding of Request-URI 
As defined in TS 24.229 [52] 

8.109 Extended registry application data 

See ETSI TS 102 223 [32] clause 8.93. 

8.110 lARI 



Byte(s) 


Description 


Length 


1 


lARI Tag 


1 


2 


Length 


1 


3 to X+2 


lARI value 


X 


NOTE: X>0 



Coding: 

- lARI value shall be coded as specified in TS 24.229 [52]. 
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Byte(s) 


Description 


Length 


1 


IMPUList Tag 


1 


2 


Length 


X 


3 


URITLVtag 


1 


4 


URI TLV length 


z 















Coding: 



For contents and syntax of URI TLV data object values see IETF RFC 3261 [53]. The URI shall 
be encoded to an octet string according to UTF-8 encoding rules as specified in IETF RFC 3629 
[54]. The tag value of the URI TLV data object shall be '80'. 



8.112 IMS status code 



Byte(s) 


Description 


Length 


1 


IMS Status-code Tag 


1 


2 


Length 


1 


3 to X+2 


IMS Status-code 


X 


NOTE: X>0 



• Coding: 

The IMS Status-code will be coded as specified in 3GPP TS 24.229 [52]. 



8.113 eCAT client profile 

Not required by 3GPP. 

8.114 eCAT client identity 

Not required by 3GPP. 

8.115 Encapsulated envelope type 

Not required by 3GPP. 

8.116 IP address list 



Byte(s) 


Description 


Length 


1 


IP address list Tag 


1 


2 


Length 


1 


3 to (2-hX) 


Other address TLV object(s) 


X 



Content : 

List of IP addresses on the H(e)NB -network interface. 
Coding: 

coding of Other address : see clause 8.58. 
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8.117 Surrounding macrocells 



Byte(s) 


Description 


Length 


1 


Surrounding macrocell list Tag 


1 


2 


Length 


1 


3 to 5 


Access Technology TLV object(s) 


3 


6 to 6+X 


Location information TLV object(s) 


X 



Content : 

List of surrounding macrocells, per access technology 
Coding: 

coding of Access Technology : see clause 8.62. 
- coding of Location Information : see clause 8.19. 



9 Tag values 

This clause specifies the tag values used to identify the BER-TLV and COMPREHENSION-TLV data objects used in 
the present document, in addition to those defined in ETSI TS 101 220 [43]. 

9.1 BER-TLV tags in IVIE to UICC direction 



Description 


Length of tag 


Value 


SMS-PP download tag 




'D1' 


Cell Broadcast download tag 




'D2' 


MO Short message control tag 




'D5' 


USSD download tag 




'D9' 


Geographical Location 
Reporting tag 




'DD' 



9.2 BER-TLV tags in UICC TO ME direction 



No additional tag is defined for 3G. 
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9.3 COMPREHENSION-TLV tags in both directions 



Description 


Length of tag 


Tag value, bits 1-7 
(Range: -or -'7E') 


Tag 
(CR and Tag value) 


Reassign 
(see NOTE) 


SS string tag 




'09' 


'09' or '89' 


yes 


USSD string tag 




'OA' 


'OA' or '8A' 


yes 


SMS TPDU tag 




'OB' 


'OB' or '8B' 


yes 


Cell Broadcast page tag 




'OC 


'OC or '8C' 


yes 


Cause tag 




'1A' 


'1A'or'9A' 


yes 


BCCH channel list tag 




'ID' 


'1D'or'9D' 


yes 


BC Repeat Indicator tag 




'2A' 


'2A' or 'AA' 


yes 


Timing Advance tag 




'2E' 


'2E' or 'AE' 


yes 


PDP context Activation parameters tag 




"52" 


"52" or "D2" 


yes 


UTRAN/E-UTRAN Measurement 
Qualifier tag 




'69' 


'69' or 'E9' 


yes 


l-WLAN Identifier tag 




'4A' 


'4A' or 'CA' 


yes 


l-WLAN Access Status tag 




'4B' 


'4B' or 'CB' 


yes 


PLMNwAcT List tag 




'72' 


'72' or 'F2' 


yes 


Routing Area Information tag 




'73' 


'73' or 'F3' 


yes 


Update/Attach Type tag 




'74' 


'74' or 'F4' 


yes 


Rejection Cause Code tag 




'75' 


'75' or 'F5' 


yes 


Geograpliical Location Parameters tag 




'76' 


'76' or 'F6' 


yes 


lARI tag 


GAD shapes tag 




'77' 


'77' or 'F7' 


yes 


IMPU list tag 


NMEA sentence tag 




'78' 


'78' or 'F8' 


yes 


IMS Status-Code tag 


PLMN List tag 




'79' 


'79' or 'F9' 


yes 


EPS PDN connection Activation 
parameters tag 




'7C' 


'7C' or 'FC 


yes 


Tracking Area Identification tag 




'7D' 


'7D'or'FD' 


yes 


CSG ID list tag 




'7E' 


'7E' or 'FE' 


yes 


CSG cell selection status tag 




'55' 


'55' or 'D5' 


yes 


CSG ID tag 




'56' 


'56' or 'D8' 


yes 


HNB name tag 




'57' 


'57' or 'D7' 


yes 


IMS Request-URI tag 




'31' 


'31'or'B1' 


yes 


IP address list tag 




'aa' 


'aa' or 'bb' 


yes 


Surrounding macrocells tag 




'cc' 


'cc' or 'dd' 


yes 


NOTE: Starting from Release 10, tag values are assigned in a context specific manner, i.e. the san 
can be used for different data objects, provided that the object can be uniquely identified fro 
of the proactive command or ENVELOPE command in which it is used. 
The column "Reassign" indicates whether it is expected that a tag can be reassigned in a cc 
manner (yes), whether that is not recommended (NR) because of potential future conflicts o 
not be done (no). 


le tag value 
m the context 

)ntext specific 
r if this shall 
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9.4 Type of Command and Next Action Indicator 

The table below shows the values which shall be used for Type of Command coding (see clause 8.6) and Next Action 
Indicator coding (see clause 8.24) in addition to those defined in ETSI TS 102 223 [32] clause 9.4. 



Value 


Name 


used for Type of 
Command coding 


used for Next Action 
Indicator coding 


'11' 


SEND SS 


X 


X 


'12' 


SEND USSD 


X 


X 


'16' 


Geographical Location Request 


X 





10 Allowed Type of command and Device identity 
combinations 

Only certain types of commands can be issued with certain device identities. These combinations are defined below, in 
addition to ETSI TS 102 223 [32] clause 10. 



Command description 


Source 


Destination 


CELL BROADCAST DOWNLOAD 


Network 


UICC 


MO SHORT MESSAGE CONTROL 


ME 


UICC 


SENDSS 


UICC 


Network 


SEND USSD 


UICC 


Network 


l-WLAN Access Status 


ME 


UICC 


Networl< Rejection 


Network 


UICC 


Geographical Location Request 


UICC 


ME 



1 1 Security requirements 



TS 31.115 [41] and TS 31.116 [51] specify standardized methods of securing the content of application messages. If it 
is necessary to secure application messaging to Toolkit applications, then TS 31.115 [41] and TS 31.116 [51] may be 
used. 
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Annex A (normative): 

Support of USAT by Mobile Equipment 

Support of USAT is optional for Mobile Equipment. However, if an ME states conformance with a specific 3G/LTE 
release, it is mandatory for the ME to support all functions of that release. 

The support of USAT impHes the support of CAT (ETSI TS 102 223 [32]). 

The support of letter classes, which specify mainly ME hardware dependent features, is optional for the ME and may 
supplement the USAT functionality described in the present document. If an ME states conformance to a letter class, it 
is mandatory to support all functions within the respective letter class. 

The table below indicates the commands and functions of the optional letter classes. 



Letter classes 


Command/function description 


ato m 


See TS 1 02 223 [32] 


n 


Proactive command: Geographical Location Request 
Envelope command: Geographical Location Reporting 





See TS 1 02 223 [32] 


P 


USSD Data download in application mode 


q 


Proactive command : Provide Local Information (GSG cell 

discovery) 

Event download : CSG cell selection 


r 


See TS 102 223 [32] 


s 


See TS 1 02 223 [32] 


t 


Event download: Incoming IMS Data 

Event download: IMS Registration 

Proactive command : OPEN CHANNEL for IMS 


u 


See TS 102 223 [32] 


V 


Proactive command : Provide Local Information (H{e)NB 
IP address) 


w 


Proactive command : Provide Local Information (H(e)NB 
surrounding macrocells) 
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Annex B (informative): 

Example of DISPLAY TEXT Proactive UICC Command 

See ETSI TS 102 223 [32] Annex B. 



£75/ 



3GPP TS 31 .1 1 1 version 1 1 .3.0 Release 11 1 04 ETSI TS 1 31 1 1 1 V1 1 .3.0 (201 2-1 0) 



Annex C (normative): 

Structure of USAT communications 



See ETSI TS 102 223 [32] Annex C. 
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Annex D (informative): 

ME display in proactive UICC session 

See ETSI TS 102 223 [32] Annex D. 
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Annex E (informative): 

Help information feature processing 

See ETSI TS 102 223 [32] Annex E. 
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Annex F (informative): 
Monitoring of events 

In addition to ETSI TS 102 223 [32] Annex F. , the following is defined: 



Event 


Continuously reported 


Reported once 


l-WLAN Access Status 


X 




Network Rejection 


X 




CSG cell selection 


X 
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Annex G (normative): 

Support of Multiple Card Operation 

See ETSI TS 102 223 [32] Annex G. 
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Annex H (informative): 

Multiple Card proactive command examples 

See ETSI TS 102 223 [32] Annex H. 
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Annex I (informative): 

Bearer independent protocol proactive command examples 

See ETSI TS 102 223 [32] Annex L 
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Annex J (informative): 
WAP References 

See ETSI TS 102 223 [32] Annex J. 
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Annex K (informative): 

Use of USAT Bearer independent protocol for local links 

Bluetooth case 

See ETSI TS 102 223 [32] Annex K. 
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Annex L (informative): 

Bluetooth Service Discovery protocol 

See ETSI TS 102 223 [32] Annex L. 
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Annex M (informative): 

Use of USAT Bearer independent protocol for local links, 

server case 

See ETSI TS 102 223 [32] Annex M. 
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Annex N (informative): 

USSD information flow between the Network, the IVIE and 

the UICC 



N.1 MMI Mode 



Mobile initiated USSD operation, Nentwork does not request further information 



Network 



ME 



UICC 



REGISTER 



Facility (Invoke = ProcessUnstructuredSS-Request (ussd- 
DCS, ussd-String)) 



Release Complete 



Facility (Return result = ProcessUnstructuredSS-Request 
(ussd-DCS, ussd-String)) 



Figure N.I 



SEND USSD 



ussd-DCS(7 bits), ussd-String 



TERMINAL RESPONSE 



DCS, text string data object 
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Mobile initiated USSD operation, Network requests further information 



Network 



ME 



UICC 



REGISTER 



Facility (Invoke = ProcessUnstructuredSS-Request (ussd- 
DCS, ussd-String)) 



FACILITY 



Facility (Invoke = UnstructuredSS-Request (ussd-DCS, ussd- 
String)) 



FACILITY 



Facility (Return result = UnstructuredSS-Request (ussd- 
DCS, ussd-String)) 



Release Connplete 



Facility (Return result = ProcessUnstructuredSS-Request 
(ussd-DCS, ussd-String)) 



SEND USSD 



ussd-DCS(7 bits), ussd-String 



TERMINAL RESPONSE 



DCS, text string data object 



Figure N.2 
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N.2 Application IVIode 

Mobile initiated USSD operation, Network does not request further information 



Network 



ME 



UICC 



REGISTER 



Facility (Invoke = ProcessUnstructuredSS-Request (ussd- 
DCS, ussd-String)) 



Release Complete 



Facility (Return result = ProcessUnstructuredSS-Request 
(ussd-DCS, ussd-String)) 



SEND USSD 



ussd-DCS(8 bits), ussd-String 



TERMINAL RESPONSE 



DCS, text string data object 



ENVELOPE(USSD Data Download) 
ussd-DCS, ussd-String 



Figure N.3 
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Mobile initiated USSD operation, Network requests further information 



Network 



ME 



UICC 



REGISTER 



Facility (Invoke = ProcessUnstructuredSS-Request (ussd- 
DCS, ussd-String)) 



FACILITY 



Facility (Invoke = UnstructuredSS-Request (ussd-DCS, ussd- 
String)) 



FACILITY 



Facility (Return result = UnstructuredSS-Request (ussd- 
DCS, ussd-String)) 



Release Complete 



Facility (Return result = ProcessUnstructuredSS-Request 
(ussd-DCS, ussd-String)) 



SEND USSD 



ussd-DCS(8 bits), ussd-String 



TERMINAL RESPONSE 



DCS, text string data object 



ENVELOPE(USSD Data Download) 
ussd-DCS, ussd-String 



SEND USSD 



ussd-DCS, ussd-String 



TERMINAL RESPONSE 



DCS, text string data object 



ENVELOPE(USSD Data Download) 
ussd-DCS, ussd-String 



Figure N.4 
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N.3 USSD Data Download 



Network initiated USSD operation 



Network 



ME 



UICC 



REGISTER 



Facility (Invoke = UnstructuredSS-Request (ussd- 
DCS, ussd-String)) 



FACILITY 



Facility (Return result = UnstructuredSS-Request (ussd- 
DCS, ussd-String{data))) 



Release Complete 



Facility (Return result = ProcessUnstructuredSS-Request 
(ussd-DCS, ussd-String)) 



ENVELOPE(USSD Data Download) 
ussd-DCS, ussd-String 



Status word 



e.g. 61 XX 



GET RESPONSE 



Data, Status word 



ENVELOPE(USSD Data Download) 
ussd-DCS, ussd-String 



Status word 



Figure N.5 
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Annex O (informative): 

Geographical location information discovery information flow 

between the ME and the UICC 

The ME accepts the parameters provided by the UICC 



Positioning system 



IVIE 



UICC 



Acquiring GPS location 



Geographical Location Request 

'81' (horizontal accuracy: best effort), '81' (vertical 

coordinate requested; vertical accuracy: best effort), 

'01' (horizontal velocity requested), '01' (Preferred 

GAD shape: Ellipsoid point), '01' (Preferred NMEA 

sentence: RIVIC), '07' (Preferred Maximum Response 

Time = 2! ) 

Terminal Response (OK) 



ENVELOPE (Geographical Location Reporting) 

> 

NMEA sentence 
(fag68$GPRMC,1 75544,V,3957.5751 ,N,0751 1 .5938, 
W,0.0,0.0,25052,12.4,W,S*24) 



Figure 0.1 
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Annex P (normative): 

Support of USAT by Terminals with reduced feature 

capabilities. 

See ETSI TS 102 223 [32] Annex S except for USAT-specific commands which are defined as follows. 
Table P.l provides the applicability of USAT-specific envelope commands for the different terminal types. 
Table P. 2 provides an overview of USAT-specific affected commands. 

Table P.1 : Envelope applicability table 



Envelope 


ND type 


NK type 


NA type 


NS type 


NL type 


SMS-PP data download 












Cell Broadcast data download 












Call Control by USIM 


Note 2 










MO Short Message Control by USIM 


Note 2 










EVENT DOWNLOAD - l-WLAN Access 
status 












EVENT DOWNLOAD - Network Rejection 












USSD Data Download 












Geographical Location Reporting 












Note 1 : "0" means proactive command is optional, No indication means that the proactive command is fully 

applicable. 
Note 2: If an alpha identifier is provided by the UICC in the response, it shall be ignored by the terminal. 



Table P.2: Overview of affected commands 



Command 


ND type 


NK type 


NA type 


NS type 


NL type 


SENDSS 


partial 










SEND USSD - MMI Mode 


partial 










SEND USSD - Application Mode 


partial 










OPEN CHANNEL related to l-WLAN 
bearer 


partial 










Geographical Location Request 


partial 










Note: "0" means support of this comma 
indication means that the proactiv 


nd is optional, 
e command is 


"partial" mean 
fully applicablf 


s parts of the c 

5 


ommand are £ 


iffected. No 
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Annex Q (normative): 

Default routing for USAT over AT interface 

The provisions of ETSI TS 102 223 [32] Annex X apply with the extensions given below. 

In addition to the facilities given in ETSI TS 102 223 [32], the facilities given in table X. 1 may be supported by 
multiple entities at the same time. 

Table Q.1 : Additional facilities that may be supported by multiple entities 



Facility 


Remarks 


Proactive UICC: REFRESH 




Proactive UICC: SET UP EVENT LIST 




Event: Data available 


Note 2 


Event: Channel status 


Note 2 


Event: Local connection 


Note 2 


Proactive UICC: OPEN CHANNEL 


Note 1 


Proactive UICC: CLOSE CHANNEL 


Note 2 


Proactive UICC: RECEIVE DATA 


Note 2 


Proactive UICC: SEND DATA 


Note 2 


Proactive UICC: GET CHANNEL STATUS 


Note 2 


Proactive UICC: SERVICE SEARCH 


Note 2 


Proactive UICC: GET SERVICE INFORMATION 


Note 2 


Proactive UICC: DECLARE SERVICE 


Note 2 


Number of channels supported by terminal 


Notes 


TCP, UICC in client mode, remote connection 


Note 2 


UDP, UICC in client mode, remote connection 


Note 2 


Note 1 : Uniqueness is provided by means of the bearer type. 
Note 2: Uniqueness is provided by means of the channel identifier. 
Note 3: The total number of channels supported shall be sum of the respective number of 
supported channels by each entity, limited to a maximum of 7. 



The list of facilities given in ETSI TS 102 223 [32] that can be provided by the MT only shall be considered a default 
ist that applies if EFufc does not exist (see TS 31.102 [14]). If EFufc exists, the list coded in this file applies. However, 
the facilities below are inherent to MT operation and shall be considered MT only even if not indicated so in EFufc- 

PROVIDE LOCAL INFORMATION (MCC, MNC, LAC/TAC, Cell Identity and Extended Cell Identity) 

PROVIDE LOCAL INFORMATION (NMR) 

POLL INTERVAL 

POLLING OFF 

PROVIDE LOCAL INFORMATION (IMEI) 

PROVIDE LOCAL INFORMATION (IMEISV) 

PROVIDE LOCAL INFORMATION (Search Mode change) 

PROVIDE LOCAL INFORMATION (NMR(UTRAN/E-UTRAN)) 



Q.1 Default routing mechanism 



In addition to the mechanism defined in ETSI TS 102 223 [32], the MT shall route USAT commands as follows: 

• SET UP EVENT LIST shall be routed to all entities supporting the command, each containing only the events 
supported by the entity, even if the list is empty (which allows for proper deregistration of events set up 
earUer). For the TERMINAL RESPONSE to the UICC, the responses from the MT and the TE have to be 
combined as follows: 
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The MT shall check if it is able to set up the events it supports itself. If the MT is currently unable to 
process command or if the set up of the events would fail, the MT shall send this result in the 
TERMINAL RESPONSE without forwarding the command to the TE. 

If the MT is capable of setting up the MT events, the list of TE events shall be forwarded to the TE and 
the TE shall send its TERMINAL RESPONSE. 

If the TE command was successful, the MT shall set up its events and report that the command was 
performed in the TERMINAL RESPONSE. If the MT or the TE or both have performed the command 
with partial comprehension or with missing information, this shall be reflected in the TERMINAL 
RESPONSE; if one reported partial comprehension and the other missing information, the MT response 
takes precedence. 

If the TE reports that it is currently unable to process command or the command failed, the MT shall 
report this in the TERMINAL RESPONSE. 

• REFRESH shall be routed to all entities supporting the command to inform them about modified Efs; only the 
MT shall perform other activities indicated in the command (e.g. UICC reset). For the TERMINAL 
RESPONSE to the UICC, the responses from the MT and the TE have to be combined as follows: 

The MT shall check if it is able to perform the REFRESH. If the MT is currently unable to process the 
command or the command would fail, the MT shall send this result in the TERMINAL RESPONSE 
without forwarding the command to the TE. 

If the MT is capable of performing the REFRESH, the command shall be forwarded to the TE and the 
TE shall send its TERMINAL RESPONSE, but if there is a refresh action to be performed by the MT 
(e.g. USIM initialisation), the MT shall send its response to the TE's TERMINAL RESPONSE only after 
the refresh action has started to avoid that the TE tries to access the UICC before the refresh action. 

If the TE command was successful, the MT shall perform the REFRESH and report that the command 
was performed in the TERMINAL RESPONSE. If the MT or the TE have performed the command with 
a limitation (partial comprehension, missing information, additional Efs read, requested icon could not be 
displayed or USIM/ISIM was not active) this shall be reflected in the TERMINAL RESPONSE; if both 
reported different limitations, the MT response takes precedence. 

If the TE reports that it is currently unable to process command or the command failed, the MT shall 
report this in the TERMINAL RESPONSE. 

• OPEN CHANNEL shall be routed according to the indicated bearer type. To avoid conflicts in channel 
identifier assignment, the MT shall replace the destination device identity by an available channel identifier 
and the entity providing the bearer type shall use this channel identifier in its response. 

• Subsequent BIP commands shall be routed according to the channel identifier. 

Q.2 Combination rules for terminal profiles 

In addition to the mechanism defined in ETSI TS 102 223 [32], the MT shall proceed as follows when combining the 
MT and TE profiles: 

• Number of channels supported by terminal for BIP: Here the indicated numbers of the different entities shall 
be added and the sum, limited to a maximum of 7, shall be provided in the combined terminal profile. 
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Annex R (informative): UICC access to IIVIS, command flow 
examples 

This annex applies if class "e" and "t" are supported. 

The flowcharts provided in this annex are illustrative examples. The listing of commands is not exhaustive and the 
timing/order of commands may differ. All SIP requests and responses received by the ME within the SIP dialog 
estabUshed by the SIP INVITE request are sent to the UICC. 



R.1 Discovery of the UlCC's lARI and IMS Registration 



UICC 



ME 



IMS network 



< TERMINAL PROFILE (support of UICC access to 

IMS) 

SET UP EVENT LIST (IMS Registration, Incoming IMS 
data, Data Available) > 

< READ BINARY (ISIM Service Table) 



Support of lARI list, SW=9000 — 
< READ BINARY (lARI list) 



lARI list, SW=9000 



< ENVELOPE (Event download - IMS Registration) 

IMPU list 



SIP REGISTER (UICC lARI(s), ME lARI(s)) 



< SIP : 200 OK 

SIP SUBSCRIBE (Registration event 
package) > 

< SIP : 200 OK 



— SIP : NOTIFY (Registration event 
package - active IMPU/contacts list) 

SIP: 200 OK > 



Figure R.I 

If the ISIM is present, the list of lARIs associated with active applications installed on the UICC is located in the ISIM. 
Otherwise, the list of lARIs associated with active applications installed on the UICC is located in the USIM. The case 
where the ISIM is supported is shown in the command flow. 

The ME will register the lARI(s) associated with active applications installed on the UICC and the lARI(s) of 
applications installed in the ME. The ME does not need to wait for SET UP EVENT LIST command to register to 
IMS. Therefore it is recommended that the UICC sends the SET UP EVENT LIST as soon as possible to avoid the case 
where the ME registers to the IMS network before the UICC can be informed of this. 

Since the IMS Registration and Incoming IMS data events may occur at anytime, it is assumed that the UICC will keep 
monitoring both events. 
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R.2 Notification of Incoming IIVIS data 



UICC 



ME 



IMS network 



< ENVELOPE (event download : Incoming IMS data) 

with the lARI 



OPEN CHANNEL for IIVIS - 
lARI, buffer size 



< Terminal Response (Channel identifier) 

< ENVELOPE (event download : Data Available) 

RECEIVE DATA > 

< Terminal Response (SIP INVITE message) 



SEND DATA (Immediate, Data) > 



< Terminal Response (OK) 



SEND DATA (Immediate, Data) > 



i Terminal Response (OK) 



- ENVELOPE (event download : Data available) with 
the Channel identifier 

RECEIVE DATA > 



< Terminal Response (OK) 

CLOSE CHANNEL(Channel identifier) > 

< Terminal Response(OK) 



i SIP: INVITE (UICC lARI) 



SIP: 200 OK 



[Messages specific ot the current SIP dialog 
not shown] 



SIP : BYE 



SIP: 200 OK 



Figure R.2 

When an incoming SIP message is received, the ME checks the lARI to see if the destination apphcation resides on ME 
or on the UICC. If the lARI is associated with an active application installed on the UICC and there is not any channel 
to the UICC associated with that lARI, the ME informs the UICC with an ENVELOPE Incoming IMS data event 
command. The UICC sends an Open Channel for IMS proactive command upon reception of this ENVELOPE 
command. At end of the SIP dialog, the UICC closes the channel to free resources. 

This flowchart occurs after a successful IMS registration is completed and the UICC is registered to the Incoming IMS 
data event. Otherwise the ME discards the incoming SIP INVITE message. 
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R.3 UICC originating a SIP message 



UICC 



ME 



IMS network 



OPEN CHANNEL for IMS > 

lARI, buffer size 

— Terminal Response (Cliannel identifier) 

SEND DATA (store, Data) > 

<: Terminal Response (OK) 

SEND DATA (Immediate, Data) > 



i Terminal Response (OK) 



< ENVELOPE (event download : Data available) with 

the Channel identifier 

RECEIVE DATA > 



< Terminal Response (OK) 

SEND DATA (Immediate, Data) > 

CLOSE CHANNEL(Channel identifier) > 

< Terminal Response(OK) 



SIP: INVITE 



i SIP : 200 OK 

[Messages specific ot the current SIP dialog 
not shown] 

< SIP : BYE 



SIP: 200 OK > 



Figure R.3 

The UICC will close the channel at the end of the SIP dialog. 



£75/ 



3GPP TS 31 .1 1 1 version 1 1 .3.0 Release 1 1 



127 



ETSI TS 131 111 V1 1.3.0 (2012-10) 



Annex S (informative): 
Change History 



TSG# 


TSG TD# 


WGTD# 


CR 


Rev 


Cat 


Subject/Comment 


New 


CT-28 


CP-050141 


Ce-050419 


144 


- 


F 


Clarification on the coding of the DCS field for USSD data 
download 


7.0.0 


CT-29 


CP-050341 


Ce-050717 


149 


- 


F 


Transfer MMS commands to SCP 


7.1.0 


CT-30 


CP-050500 


Ce-050880 


152 


- 


A 


Missing data objects concerning Frames 


7.2.0 


CT-30 


CP-050500 


Ce-050887 


150 


- 


A 


Correction of the length of Bearer parameters for UTRAN 
Packet Service 


7.2.0 


CT-30 


CP-050497 


ce-05089e 


153 


- 


B 


Extension of BIP bearers with l-WLAN 


7.2.0 


CT-31 


CP-060019 


ce-oeoi24 


155 


- 


A 


Corrections to align TS 31 .1 1 1 with ETSI TS 1 02 223 and 
ETSI TS 101 220 


7.3.0 


CT-31 


CP-060019 


C6-060127 


157 


- 


A 


Introduction of HSDPA in BIP 


7.3.0 


CT-31 


CP-060024 


ce-oeoi85 


158 


- 


D 


Editorial corrections 


7.3.0 


CT-31 


CP-060024 


ce-oeoi86 


159 


- 


F 


Alignment with SCP specifications 


7.3.0 


CT-31 


CP-060157 


C6-0e0195 


161 


- 


A 


Correction on 'USIM Service table' in data SMS-PP 
download 


7.3.0 


CT-32 


CP-060244 


C6-060320 


0162 


- 


F 


Incorrect Service Table referenced 


7.4.0 


CT-33 


CP-060476 


ce-oeoeo3 


0167 


- 


A 


UTRAN NMR encoding and Local Information clarifications 


7.5.0 


CT-35 


CP-070060 


Ce-070092 


0169 


1 


A 


Removal of re-introduced text for Call Control User 
indication 


7.6.0 


CT-36 


CP-070300 


C6-070334 


0176 


2 


F 


Correction of possible Terminal Responses to the Send 
SMS command 


7.7.0 


CT-36 


CP-070300 


C6-070320 


0181 


2 


F 


Addition of missing Frame Identifiers to proactive 
commands 


7.7.0 


CT-36 


CP-070300 


C6-070294 


0184 


- 


F 


Correction for the general results "SS Return Error" and 
"USSD Return Error" 


7.7.0 


CT-37 


CP-070616 


Ce-070419 


0185 


1 


F 


Incomplete Launch Application command definition 


7.8.0 


CT-37 


CP-070612 


Ce-070384 


0187 


- 


A 


Correction to UTRAN Network Measurement Results 


7.8.0 


CT-37 


CP-070661 


Rev2 of C6- 
070435 


0188 


5 


B 


Steering of Roaming Refresh Command 


7.8.0 


CT-38 


CP-070842 


Ce-070588 


0190 


5 


B 


Addition of EVENT: Network Rejection 


8.0.0 


CT-39 


CP-080169 


Ce-080028 


0191 


- 


F 


Correction to RAC in Event : Network Rejection 


8.1.0 














Numbering of clauses corrected 


8.1.1 


CT-40 


CP-080386 


Ce-080149 


0193 


2 


F 


Explicit definition of Provide Local Information values 


8.2.0 


CT-41 


CP-080658 




0196 


4 


B 


Introduction of a geographical location discovery 
mechanism in the USIM Toolkit 


8.3.0 




CT-41 


CP-080586 


Ce-080280 


0197 


- 


F 


Correction of a missing closing parenthesis in 31.1 11 8.19. 


8.3.0 


CT-42 


CP-080903 


Ce-080470 


0198 


3 


B 


l-WLAN Steering of Roaming Refresh Command 


8.4.0 


CT-42 


CP-080908 


Ce-080473 


0199 


1 


F 


Correct Geographical Location Request Terminal 
response value 


8.4.0 














Upgrade to copyright, keywords and logo for LTE 


8.4.0 


CT-43 


CP-090188 


Ce-090058 


201 


2 


B 


Support of EPS in USAT: BIP, Provide Local Information, 
Call control 


8.5.0 


CT-43 


CP-090188 


Ce-090064 


207 


1 


B 


Definition of the 'idle' state in Event Download (Location 
Status) to include E-UTRAN 


8.5.0 


CT-43 


CP-090190 


Ce-090060 


206 


1 


A 


Downgrade of Data download via USSD and USSD 
application mode 


8.5.0 


CT-43 


CP-090197 


C6-090017 


203 


- 


F 


Correction of formatting error in Terminal Profile and in 
section titles 


8.5.0 


CT-43 


CP-090240 




200 


1 


B 


Support of EPS in Network Rejection Event 


8.5.0 


CT-43 


CP-090242 




202 


1 


F 


Reduced USAT capable terminals 


8.5.0 














Correction to history table version entries ex CT-43. 


8.5.1 


CT-43 


CP-090455 


C6-090169 


209 


1 


A 


Correction to OPEN CHANNEL 


8.6.0 


CT-43 


CP-090456 


Ce-090114 


212 


- 


F 


NMEA sentence reference 


8.6.0 


CT-43 


CP-090452 


Ce-090170 


213 


1 


F 


IMSI changing procedure 


8.6.0 


CT-43 


CP-090456 


ce-090iie 


214 


- 


F 


Network Rejection Event for GERAN/UTRAN 


8.6.0 


CT-43 


CP-090452 


Ce-090172 


215 


1 


F 


Support of E-UTRAN in Provide Local Information for NMR 


8.6.0 


CT-45 


CP-090716 


Ce-090315 


225 


- 


A 


Correction of an open reference and clarification of display 
icon 


8.7.0 


CT-45 


CP-090715 


C6-090300 


226 


- 


F 


Correction of missing reference to 3GPP specification 


8.7.0 


CT-46 


CP-090994 


Ce-090465 


220 


2 


B 


Discovery of surrounding CSG cells 


9.0.0 


CT-46 


CP-090994 


ce-09046e 


227 


1 


B 


CSG cell selection event 


9.0.0 


CT-47 


CP-100186 


Ce-1 00089 


235 


- 


F 


Completion of implementation of CR 0227 (tag values) 


9.1.0 


CT-47 


CP-100186 


ce-100104 


236 


- 


F 


Correction of erroneous use of the "H(e)NB" term 


9.1.0 


CT-47 


CP-100181 


Ce-1 00082 


231 


2 


A 


ETSI SCP references correction 


9.1.0 


CT-48 


CP-1 00392 


C6-1 00271 


0243 


1 


F 


Update of the specification and of references to SCP 
specifications 


9.2.0 


CP-48 


CP-1 00393 


C6-1 00289 


0240 


1 


A 


Correction to security requirement references 


9.2.0 
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New 


CP-48 


CP-1 00393 


C6-1 00296 


0248 


1 


A 


Correction of TERMINAL RESPONSE 


9.2.0 


CP-49 


CP-1 00596 


C6-1 00329 


0254 




F 


HNB name corrections 


9.3.0 


CP-49 


CP-1 00595 


C6-1 00332 


0257 


- 


D 


Editorial correction in Comprehention-TLV Tag list 


10.0.0 


CP-50 


CP-1 00828 


C6-1 00638 


0272 


1 


A 


Reference update and restoration of the Terminal Profile's 
bytes with letter class 


10.1.0 


CP-50 


CP-1 00828 


C6-1 00641 


0271 


1 


A 


Essential corrections to NMR and UTRAN/E-UTRAN 
Measurement Qualifier 


10.1.0 


CP-50 


CP-1 00825 


C6-1 00645 


0270 


2 


B 


Communication control for IMS 


10.1.0 


CP-50 


CP-1 00841 




0274 


- 


A 


Clarification on EVENT DOWNLOAD - CSG cell selection 


10.1.0 


CP-51 


CP-1 10239 


C6-1 10063 


0275 


1 


B 


Rules for multiple entities providing USAT facilities 


10.2.0 


CP-51 


CP-1 10243 


C6-1 10080 


0276 


1 


C 


Addition of Direct Communication Channel for BIP terminal 
server mode 


10.2.0 


CP-51 


CP-1 10238 


C6-110155 


0279 


1 


B 


Introduction of the lARI based Incoming IMS Data event 


10.2.0 


CP-51 


CP-1 10238 


C6-110156 


0280 


1 


B 


Introduction of ME behaviour during a REFRESH of 
EF UICCIARI 


10.2.0 


CP-51 


CP-1 10238 


C6-110167 


0281 


- 


B 


Introduction of the lARI based IMS Registration event 


10.2.0 


CP-51 


CP-1 10298 




0282 


4 


B 


Introduction the lARI based Open Channel command 


10.2.0 


CP-51 


CP-1 10243 


C6-110193 


0290 


1 


C 


Enable Re-assignment of tag values 


10.2.0 


CP-51 


CP-1 1021 7 




0292 




A 


Essential corrections to the CSG cell selection status 
event and command PROVIDE LOCAL INFORMATION 
related to CSG 


10.2.0 


CP-52 


CP-1 10530 




0291 


2 


F 


Essential correction on the length size for the IMS 
Registration Event envelope command 


10.3.0 


CP-52 


CP-1 10530 




0292 


2 


F 


Correction to IMS Registration event letter class 


10.3.0 


CP-52 


CP-1 10530 




0294 


3 


F 


Reservation of a bit in Terminal profile for Open Channel 
for IMS 


10.3.0 


CP-52 


CP-1 10499 


C6-1 10287 


0296 


2 


A 


Removal of the mandatory Home eNodeB name support in 
USAT 


10.3.0 


CP-53 


CP-1 10596 


C6-1 10404 


0297 


2 


F 


Corrections to IMS Registration Event and Open Channel 
for IMS USAT commands 


10.4.0 


CP-54 


CP-110901 


C6-1 10586 


0300 


1 


F 


Essential correction to call control by USIM using IMS 
Request-URI parameter 


10.5.0 


CP-54 


CP-1 10901 


C6-1 10589 


0304 


1 


F 


Alignment with ETSI TS 102 223 regarding eCAT 


10.5.0 


CP-54 


CP-110901 


C6-1 10590 


0303 


1 


F 


Correction of USAT over AT commands 


10.5.0 


CP-54 


CP-110901 


C6-1 10587 


0301 


2 


A 


Essential correction to call control by USIM using IMS 
Request-URI parameter 


11.0.0 


CP-54 


CP-110900 


C6-1 10580 


0299 


2 


C 


Definition of procedures for Steering of Roaming 


11.0.0 


CP-55 


CP-1 201 46 


C6-1 20089 


0313 


1 


A 


Update of reference to ETSI TS 102 223 


10.6.0 


CP-55 


CP-1 201 47 


C6-120101 


0317 




A 


Correction to channel status data object 


10.6.0 


CP-56 


CP-1 20387 


C6-1 20260 


321 


1 


A 


Correction of bearer parameters for E-UTRAN / mapped 
UTRAN packet service 


10.7.0 


CP-56 


CP-1 20388 


C6-1 20269 


322 


1 


D 


Deletion of COMPREHENSION-TLV tag value from 3GPP 
specification 


10.7.0 


CP-56 


CP-1 20388 


C6-1 20270 


324 


1 


D 


Correction in the Geographical location information 
discovery information flow between the ME and the UICC 


10.7.0 


CP-56 


CP-1 20406 


C6-1 20281 


315 


3 


B 


Addition of Provide local information, H(e)NB IP address 


10.7.0 


CP-56 


CP-1 20406 


C6-1 20282 


316 


4 


B 


Addition of Provide local information, H(e)NB surrounding 
macrocells 


10.7.0 


CP-57 


CP-1 20624 


C6-1 20324 


0328 




A 


Correction of length of CSG ID 


11.3.0 


CP-57 


CP-1 20624 


C6-1 20422 


0331 


1 


A 


Correction of CSG ID list identifier 


11.3.0 


CP-57 


CP-1 20624 


C6-1 20425 


0334 


1 


A 


Changes in ENVELOPE (EVENT DOWNLOAD - CSG Cell 
Selection) 


11.3.0 


CP-57 


CP-1 20625 


C6-1 20390 


0344 


1 


A 


Clarification of the use of the Incoming IMS Data event 


11.3.0 


CP-57 


CP-1 20623 


C6-1 20449 


0349 


2 


C 


Enhancements to the security of the SMS OTA download 
mechanisms 


11.3.0 


CP-57 


CP-1 20626 


C6-120419 


0338 


1 


D 


Correction to reference for 'OPEN CHANNEL related to 
UICC Server Mode' 


11.3.0 
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